Missing Authorization in Meta Box AIO Plugin for WordPress

CVE-2026-14488

What is CVE-2026-14488?

The Meta Box AIO plugin for WordPress is susceptible to a Missing Authorization vulnerability found in the MB Frontend Submission extension. This flaw allows unauthenticated users to delete arbitrary posts and pages, as the handle_request() function permits the mbfs_delete action without appropriate capability or ownership checks. Moreover, nonce verification in check_ajax() is reliant on is_ajax(), which evaluates to false for template_redirect requests, effectively bypassing necessary security measures. This issue enables potential attackers to manipulate post deletions by using a crafted post ID within the rwmb_frontend_field_object_id GET parameter, jeopardizing the integrity of websites utilizing this plugin.

References