CVE-2026-14488

Received Received - Intake

Missing Authorization in Meta Box AIO WordPress Plugin

Publication date: 2026-07-29

Last updated on: 2026-07-29

Assigner: Wordfence

Description

The Meta Box AIO plugin for WordPress is vulnerable to Missing Authorization via the template_redirect dispatcher in the MB Frontend Submission extension in versions up to, and including, 3.8.0. This is due to the handle_request() function routing the mbfs_delete action without any capability or ownership check, and the nonce verification in check_ajax() being gated behind is_ajax() which is false for template_redirect requests, making it bypassable. This makes it possible for unauthenticated attackers to delete arbitrary posts and pages by supplying an attacker-controlled post ID via the rwmb_frontend_field_object_id GET parameter on any page that hosts a frontend submission form regardless of whether allow_delete is enabled.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-29

Last Modified

2026-07-29

Generated

2026-08-19

AI Q&A

2026-07-30

EPSS Evaluated

2026-08-18

NVD

CVE-2026-14488

Affected Vendors & Products

Vendor	Product	Version / Range
meta_box	aio_plugin	to 3.8.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

The Meta Box AIO WordPress plugin has a vulnerability in its MB Frontend Submission extension up to version 3.8.0. It allows unauthenticated attackers to delete any post or page by exploiting a missing authorization check in the template_redirect dispatcher. The vulnerability bypasses nonce verification, enabling attackers to supply a malicious post ID via a GET parameter.

Detection Guidance

Check WordPress sites with Meta Box AIO plugin version 3.8.0 or lower. Look for unauthorized post or page deletions in logs. Inspect frontend submission forms for the mbfs_delete action without proper authentication.

Impact Analysis

This vulnerability allows attackers to delete any posts or pages on your WordPress site without authentication. If you use the Meta Box AIO plugin with the MB Frontend Submission extension, your site's content could be erased, leading to data loss and potential site disruption.

Compliance Impact

This vulnerability could lead to unauthorized deletion of posts and pages, potentially compromising data integrity. For GDPR, this may violate Article 5 (integrity and confidentiality) and Article 32 (security of processing). For HIPAA, it could affect the integrity of protected health information if such data is stored in affected posts or pages.

Mitigation Strategies

Update the Meta Box AIO plugin to the latest version. Remove or disable the MB Frontend Submission extension if not needed. Implement strict access controls and monitor for suspicious activity.

Hi! I’m here to help you understand CVE-2026-14488. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70