CVE-2026-13355
Received Received - Intake

Privilege Escalation in Meta Box AIO WordPress Plugin

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: Wordfence

Description
The Meta Box AIO plugin for WordPress is vulnerable to Privilege Escalation to Administrator in versions up to, and including, 3.11.0. This is due to a chained flaw: the populate_via_query_string() function in the mb-frontend-submission component unconditionally overrides the form's target object_id from the GET parameter 'rwmb_frontend_field_object_id' without any authorization check, and Form::process() lacks the user_can_edit() check present in render(), allowing unauthenticated attackers to overwrite the post_content of any page with an arbitrary shortcode via wp_update_post(); the mb-user-profile component then directly trusts the 'role' and 'auto_login' shortcode attributes in the injected [mb_user_profile_register] shortcode with no role validation. This makes it possible for unauthenticated attackers to elevate their privileges to Administrator. The standalone plugins Meta Box Frontend Submission (in versions up to 4.5.6) and Meta Box User Profile (versions up to 3.11.0) are also affected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-22
Last Modified
2026-09-22
Generated
2026-09-22
AI Q&A
2026-09-22
EPSS Evaluated
N/A
NVD
CVE-2026-13355
EUVD
EUVD-2026-84268

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
meta_box meta_box_aio to 3.11.0 (inc)
meta_box meta_box_frontend_submission to 4.5.6 (inc)
meta_box meta_box_user_profile to 3.11.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-269 The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability allows unauthenticated attackers to escalate their privileges to Administrator in WordPress sites using vulnerable Meta Box plugins. It involves two flaws: one in the frontend submission component that lets attackers modify post content via a shortcode, and another in the user profile component that trusts unvalidated role parameters in shortcodes.

Detection Guidance

Check for unauthorized administrator accounts or unexpected shortcode injections in WordPress pages. Inspect GET requests containing 'rwmb_frontend_field_object_id' or '[mb_user_profile_register]' shortcodes. Review user roles and privileges for anomalies.

Impact Analysis

An attacker could take full control of your WordPress site, modify content, install malicious plugins, steal data, or disrupt operations. Since it requires no authentication, any unauthenticated user could exploit it if your site uses the vulnerable Meta Box AIO plugin versions up to 3.11.0 or standalone plugins up to 4.5.6 and 3.11.0.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR's data protection requirements and HIPAA's security rules for protected health information. Unauthorized privilege escalation may result in non-compliance, legal penalties, and reputational damage due to compromised sensitive data.

Mitigation Strategies

Update Meta Box AIO to version 3.12.0 or later, Meta Box Frontend Submission to 4.5.7 or later, and Meta Box User Profile to 3.12.0 or later. Remove any suspicious administrator accounts and audit shortcode usage in WordPress content.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-13355. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart