WordPress Meta Box AIO Plugin Carries Critical Authorization Bypass

Unauthenticated attackers can delete arbitrary posts and pages in sites running the Meta Box AIO plugin for WordPress.

A missing authorization flaw affects versions up to, and including, 3.8.0. The issue, tracked as CVE-2026-14488, originates in the template_redirect dispatcher within the MB Frontend Submission extension. According to Wordfence, the handle_request() function processes the mbfs_delete action without performing any capability or ownership verification.

The plugin's nonce check inside check_ajax() sits behind an is_ajax() guard that evaluates to false during template_redirect calls, allowing the verification to be bypassed. Attackers can therefore delete any post or page by supplying a chosen ID through the rwmb_frontend_field_object_id GET parameter on pages that contain a frontend submission form.

The flaw exists on any page hosting a frontend submission form. Exploitation succeeds regardless of whether the allow_delete setting is active. Wordfence assigned the vulnerability a CVSS 3.1 base score of 9.1, with the vector string "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H".

The National Vulnerability Database published the CVE record on July 29, 2026. It was received from Wordfence the same day at 7:16:48 AM. The weakness is classified as CWE-862, Missing Authorization.

References include the official changelog and a detailed Wordfence advisory. The affected product listing shows Meta Box Meta Box AIO as impacted from version 0 through 3.8.0. The changelog at metabox.io and the Wordfence threat intel page provide additional details on the issue.