WordPress Meta Box AIO Plugin Carries Critical Authorization Bypass

The Meta Box AIO WordPress plugin is vulnerable to missing authorization (CVE-2026-14488, CVSS 9.1) in versions up to 3.8.0, allowing unauthenticated attackers to delete arbitrary posts and pages via a bypassable nonce check. The flaw impacts any site with a frontend submission form regardless of delete settings.

Source:NVD

Post

WordPress Meta Box AIO Plugin Carries Critical Authorization Bypass

TL;DRAI · 60 sec read

Unauthenticated attackers can delete arbitrary posts and pages in sites running the Meta Box AIO plugin for WordPress.

A missing authorization flaw affects versions up to, and including, 3.8.0. The issue, tracked as CVE-2026-14488, originates in the template_redirect dispatcher within the MB Frontend Submission extension. According to Wordfence, the handle_request() function processes the mbfs_delete action without performing any capability or ownership verification.

The plugin's nonce check inside check_ajax() sits behind an is_ajax() guard that evaluates to false during template_redirect calls, allowing the verification to be bypassed.

The plugin's nonce check inside check_ajax() sits behind an is_ajax() guard that evaluates to false during template_redirect calls, allowing the verification to be bypassed. Attackers can therefore delete any post or page by supplying a chosen ID through the rwmb_frontend_field_object_id GET parameter on pages that contain a frontend submission form.

From The CircuitryThe Feed — live briefs across tech, all day.See what’s happening →

The flaw exists on any page hosting a frontend submission form. Exploitation succeeds regardless of whether the allow_delete setting is active. Wordfence assigned the vulnerability a CVSS 3.1 base score of 9.1, with the vector string "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H".

Exploitation succeeds regardless of whether the allow_delete setting is active.

The National Vulnerability Database published the CVE record on July 29, 2026. It was received from Wordfence the same day at 7:16:48 AM. The weakness is classified as CWE-862, Missing Authorization.

References include the official changelog and a detailed Wordfence advisory. The affected product listing shows Meta Box Meta Box AIO as impacted from version 0 through 3.8.0. The changelog at metabox.io and the Wordfence threat intel page provide additional details on the issue.

Why this mattersAI · ~100 words

Tap a lens to see what this story means for you.

Reader-supported

DonateBuy me a coffee →Follow@thecircuitry_ →Follow@thecircuitry.to →

Reader-supported · The Brief

Liked this? The Brief brings you the whole day in tech, verified, every morning. Two minutes, free forever.

HELP US IMPROVE

Reader-supported

The Circuitry is a passion project I've always wanted to build, and I love the work behind it.

Running it costs real money. APIs, hosting, time. To keep improving the site and growing this into something useful for everyone, those costs have to be covered.

Any contribution is appreciated. If not, no pressure. Thanks for reading.

Buy me a coffee

WordPress Security Vulnerability

MORE IN TECH

Bloomberg Report Details Why PlayStation Dropped Physint Project

A Bloomberg report citing anonymous sources claims that disappointing commercial performance of Kojima’s prior Death Stranding titles, missed deadlines, ballooning costs, and limited exclusivity led PlayStation to cancel Physint. Xbox will now partner with the developer on the project.

Tesla Sends Invites for Semi Rollout Event on September 24

Tesla has started sending invitations for its Semi Rollout event on September 24 at the new factory in Sparks, Nevada. The gathering will showcase the 1.7 million-square-foot facility built to produce up to 50,000 trucks per year along with refreshed vehicle features and fleet economics.

Anthropic Disrupts Malicious Attempts to Weaponize Its AI Models

Anthropic thwarted unidentified actors seeking to use its Claude model for gain-of-function research on the chikungunya virus that could support bioweapon development. The firm issued its latest misuse report, following earlier ones in March, August, and November 2025, warning that advancing AI capabilities heighten risks unless developers and governments collaborate on stronger defenses.