CVE-2026-13355

CriticalCVSS 9.8

Published: 22/09/2026(UTC)Translated: 22/09/2026(UTC)NVD NIST

Summary

The Meta Box AIO plugin for WordPress is vulnerable to Privilege Escalation to Administrator in versions up to, and including, 3.11.0. This is due to a chained flaw: populate_via_query_string() unconditionally overrides the form's target object_id without authorization checks, and Form::process() lacks the user_can_edit() check, allowing unauthenticated attackers to overwrite any page's post_content with an arbitrary shortcode via wp_update_post(); the mb-user-profile component then trusts the 'role' and 'auto_login' shortcode attributes in the injected [mb_user_profile_register] shortcode without role validation. The standalone plugins Meta Box Frontend Submission (up to 4.5.6) and Meta Box User Profile (up to 3.11.0) are also affected.

Risk Assessment

An unauthenticated attacker can take full control of the WordPress site by gaining Administrator privileges. This poses a critical risk to the confidentiality, integrity, and availability of the entire site.

Recommendation

Immediately update the Meta Box AIO, Meta Box Frontend Submission, and Meta Box User Profile plugins to versions newer than those listed, and if updating is not possible, consider disabling the vulnerable plugins.

Other vulnerabilities in Meta Box AIO

CVE-2026-14488Critical
Meta Box AIO plugin for WordPress up to 3.8.0 (with MB Frontend Submission) lacks authorization in the template_redirect dispatcher. The handle_request() function routes the mbfs_delete action without capability checks, and nonce verification is bypassed because is_ajax() returns false for template_redirect requests. Unauthenticated attackers can delete arbitrary posts and pages by supplying a post ID via the rwmb_frontend_field_object_id parameter.

Original NVD description (English source)

The Meta Box AIO plugin for WordPress is vulnerable to Privilege Escalation to Administrator in versions up to, and including, 3.11.0. This is due to a chained flaw: the populate_via_query_string() function in the mb-frontend-submission component unconditionally overrides the form's target object_id from the GET parameter 'rwmb_frontend_field_object_id' without any authorization check, and Form::process() lacks the user_can_edit() check present in render(), allowing unauthenticated attackers to overwrite the post_content of any page with an arbitrary shortcode via wp_update_post(); the mb-user-profile component then directly trusts the 'role' and 'auto_login' shortcode attributes in the injected [mb_user_profile_register] shortcode with no role validation. This makes it possible for unauthenticated attackers to elevate their privileges to Administrator. The standalone plugins Meta Box Frontend Submission (in versions up to 4.5.6) and Meta Box User Profile (versions up to 3.11.0) are also affected.