WordPress Plugin Vulnerabilities

Meta Box < 5.13.1 - Contributor+ Arbitrary Attachment Deletion via IDOR

Description

The plugin does not verify that a user is authorized to delete the supplied attachment before deleting it, allowing users with a low-privilege role such as Contributor to permanently delete arbitrary media attachments belonging to other users.

Proof of Concept

Affects Plugins

Plugin icon
meta-box
Fixed in 5.13.1

References

CVE
CVE-2026-15248

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
5.5 (medium)

Miscellaneous

Original Researcher
Duy Tran
Submitter
Duy Tran
Submitter website
https://mrdarkroot.github.io/
Verified
Yes
WPVDB ID
a101136d-606f-4529-ae78-a4fff7724e2c

Timeline

Publicly Published
2026-07-20 (about 2 days ago)
Added
2026-07-20 (about 2 days ago)
Last Updated
2026-07-22 (about 3 hours ago)

Other

Published
Title
Published
2025-04-09
Title
Age Gate < 3.6.0 - Missing Authorization
Published
2025-04-01
Title
Cue < 2.4.5 - Missing Authorization
Published
2025-04-17
Title
Eduma < 5.6.5 - Missing Authorization
Published
2026-02-10
Title
WaMate Confirm < 2.0.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Phone Number Blocking/Unblocking
Published
2024-05-31
Title
User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin < 3.2.1 - Missing Authorization to Privilege Escalation