{
 "id": "WPSEC-2026-1300",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1300/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1300/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1300/index.md",
 "title": "Meta Box - WordPress Custom Fields Framework <= 5.15.2 - Authenticated (Contributor+) Sensitive Information Exposure via Block Bindings",
 "description": "The Meta Box plugin for WordPress is vulnerable to Sensitive Information Exposure via the block bindings source in all versions up to, and including, 5.15.2, due to the user-supplied binding 'key' being used to read any property or array element of the bound field value without an allowlist, and posts referenced by post fields being returned without checking whether they are readable. This makes it possible for authenticated attackers, with contributor-level access and above, to bind blocks to arbitrary properties of the referenced objects. This exposes data such as the password hash and email address of any user selected in a user field, or the content and password of private or password-protected posts selected in a post field. Exploitation requires a user or post field to be registered on a post type the attacker can edit.",
 "plugin": {
  "slug": "meta-box",
  "name": "Meta Box - WordPress Custom Fields Framework",
  "full_name": "Meta Box – A Framework for Dynamic Websites",
  "wordpress_org": "https://wordpress.org/plugins/meta-box/",
  "advisories_url": "https://wpsec.com/vuln/plugin/meta-box/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/meta-box"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.5,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "5.14.0",
    "from_inclusive": true,
    "to": "5.15.3",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 5.14.0 before 5.15.3"
  ]
 },
 "introduced_in": "5.14.0",
 "fixed_in": "5.15.3",
 "remediation": "Update to 5.15.3 or later.",
 "fix_released": "2026-10-20T02:20:02+00:00",
 "published": "2026-10-21T10:43:36+00:00",
 "updated": "2026-10-21T10:35:14.131920+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1300/",
  "https://plugins.svn.wordpress.org/meta-box/tags/5.15.3/",
  "https://wordpress.org/plugins/meta-box/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/meta-box",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-10-21"
 }
}