Skip to content
Sign in
5.5 Medium

CVE-2026-15248 The Meta Box WordPress plugin before 5.13.1 does not verify that a user is authorized to delete the supplied…

Description

The Meta Box WordPress plugin before 5.13.1 does not verify that a user is authorized to delete the supplied attachment before deleting it, allowing users with a low-privilege role such as Contributor to permanently delete arbitrary media attachments belonging to other users.

Affected products and versions

Product Affected versions Fixed in
Meta Box 5.13 earliest → < 5.13.1 5.13.1

Other CVEs of Meta Box

The 2 CVEs of Meta Box →
CVE-2024-1204 The Meta Box WordPress plugin before 5.9.4 does not prevent users with at least the contributor role from access… 4.3 Medium
Track this CVE