WordPress Plugin Vulnerabilities

Meta Box < 5.11.2 - Contributor+ Arbitrary File Deletion

Description

The plugin is vulnerable to arbitrary file deletion due to insufficient file path validation. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).

Affects Plugins

Plugin icon
meta-box
Fixed in 5.11.2

References

CVE
CVE-2026-39468
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/c303fffe-628b-4e88-9274-7dd242f2186e

Classification

Type
LFI
OWASP top 10
A1: Injection
CWE
CWE-22
CVSS
6.5 (medium)

Miscellaneous

Original Researcher
Nguyen Ba Khanh
Verified
No
WPVDB ID
a3492097-81cf-4ab9-a137-9c5f303888fb

Timeline

Publicly Published
2026-04-13 (about 2 months ago)
Added
2026-04-22 (about 2 months ago)
Last Updated
2026-04-22 (about 2 months ago)

Other

Published
Title
Published
2025-12-09
Title
Simple Download Counter < 2.2.3 - Authenticated (Administrator+) Arbitrary File Read via Path Traversal
Published
2015-07-07
Title
S3Bubble Cloud Video With Adverts & Analytics <= 0.7 - Arbitrary File Download
Published
2026-06-19
Title
Database for Contact Form 7, WPforms, Elementor forms < 1.5.2 - Unauthenticated Arbitrary File Deletion via CF7 File Field POST Value
Published
2025-12-11
Title
Simple CSV Table < 1.0.2 - Directory Traversal to Authenticated (Contributor+) Arbitrary File Read
Published
2014-08-01
Title
Google Document Embedder 2.4.6 - pdf.php file Parameter Arbitrary File Disclosure