WordPress Plugin Vulnerabilities

WP Meta and Date Remover < 2.3.7 - Missing Authorization

Description

The WP Meta and Date Remover plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 2.3.6. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform an unauthorized action.

Affects Plugins

Plugin icon
wp-meta-and-date-remover
Fixed in 2.3.7

References

CVE
CVE-2026-49051
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/b30c9414-0a9b-47b5-bc57-ec79f182fc9d

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Trương Hữu Phúc (truonghuuphuc)
Verified
No
WPVDB ID
99ee8b1d-d9e7-4a2d-894e-66f5f33a75e0

Timeline

Publicly Published
2026-05-27 (about 1 month ago)
Added
2026-06-01 (about 1 month ago)
Last Updated
2026-06-01 (about 1 month ago)

Other

Published
Title
Published
2025-06-25
Title
Coupon Affiliates < 7.2.1 - Missing Authorization
Published
2025-06-05
Title
No Spam At All <= 1.3 - Missing Authorization
Published
2025-01-16
Title
Copy Move Posts <= 1.6 - Missing Authorization
Published
2025-09-22
Title
CP Multi View Event Calendar <= 1.4.34 - Missing Authorization
Published
2025-01-06
Title
LazyLoad Background Images <= 1.0.7 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update