Meta Box - WordPress Custom Fields Framework <= 5.15.2 - Authenticated (Contributor+) Sensitive Information Exposure via Block Bindings
- ID
- WPSEC-2026-1300
- Plugin
- Meta Box – A Framework for Dynamic Websites (meta-box)
- Affected
- from 5.14.0 before 5.15.3
- Remediation
- Update to 5.15.3 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-21
- Attack surface
- Meta Box - WordPress Custom Fields Framework on WPSec AttackSurface
- Fix released
- Published
Description
The Meta Box plugin for WordPress is vulnerable to Sensitive Information Exposure via the block bindings source in all versions up to, and including, 5.15.2, due to the user-supplied binding 'key' being used to read any property or array element of the bound field value without an allowlist, and posts referenced by post fields being returned without checking whether they are readable. This makes it possible for authenticated attackers, with contributor-level access and above, to bind blocks to arbitrary properties of the referenced objects. This exposes data such as the password hash and email address of any user selected in a user field, or the content and password of private or password-protected posts selected in a post field. Exploitation requires a user or post field to be registered on a post type the attacker can edit.
References
- https://wpsec.com/vuln/WPSEC-2026-1300/
- https://plugins.svn.wordpress.org/meta-box/tags/5.15.3/
- https://wordpress.org/plugins/meta-box/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS