Authorization Flaw in Meta Box Plugin for WordPress Allows Unauthorized Deletion
CVE-2026-15248
Currently unrated
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-15248?
The Meta Box WordPress plugin, prior to version 5.13.1, contains a significant oversight where it fails to properly authorize users attempting to delete media attachments. This flaw enables users with lower privilege roles, such as Contributors, to erase arbitrary attachments belonging to other users without proper permission. This can lead to potential data loss and disruption of content management, emphasizing the need for immediate updates to mitigate such vulnerabilities.
Affected Version(s)
Meta Box 0 < 5.13.1
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.