Skip to content
Threat Feed
Subscribe

Vendor

Meta Box

2 briefs RSS
critical advisory

Unauthenticated Privilege Escalation in Meta Box AIO for WordPress

An unauthenticated privilege escalation vulnerability (CVE-2026-13355) in the Meta Box AIO plugin allows attackers to overwrite post content with arbitrary shortcodes to register administrative accounts.

PoC Meta Box AIO +4
1t 1c
critical advisory

Meta Box AIO Plugin Vulnerable to Unauthenticated Post Deletion via CVE-2026-14488

Unauthenticated attackers can exploit a Missing Authorization vulnerability (CVE-2026-14488) in the MB Frontend Submission extension of the Meta Box AIO plugin for WordPress, affecting versions up to 3.8.0, to delete arbitrary posts and pages by injecting a crafted post ID via a GET parameter.

Meta Box AIO plugin +1 wordpress missing-authorization web-application plugin-vulnerability cve
1r 1t 1c