Vendor

Meta Box

1 brief RSS

Meta Box AIO Plugin Vulnerable to Unauthenticated Post Deletion via CVE-2026-14488

Unauthenticated attackers can exploit a Missing Authorization vulnerability (CVE-2026-14488) in the MB Frontend Submission extension of the Meta Box AIO plugin for WordPress, affecting versions up to 3.8.0, to delete arbitrary posts and pages by injecting a crafted post ID via a GET parameter.

Meta Box AIO plugin +1 wordpress missing-authorization web-application plugin-vulnerability cve

1r 1t 1c 1h ago