# Meta Box - WordPress Custom Fields Framework <= 5.15.2 - Authenticated (Contributor+) Sensitive Information Exposure via Block Bindings

- **ID:** WPSEC-2026-1300
- **Plugin:** Meta Box – A Framework for Dynamic Websites (`meta-box`), https://wordpress.org/plugins/meta-box/
- **Affected versions:** from 5.14.0 before 5.15.3
- **Fixed in:** 5.15.3 (Update to 5.15.3 or later.)
- **Severity:** Medium 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
- **Weakness:** CWE-200
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-21)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/meta-box
- **Fix released:** 2026-10-20
- **Published:** 2026-10-21
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1300/

## Description

The Meta Box plugin for WordPress is vulnerable to Sensitive Information Exposure via the block bindings source in all versions up to, and including, 5.15.2, due to the user-supplied binding 'key' being used to read any property or array element of the bound field value without an allowlist, and posts referenced by post fields being returned without checking whether they are readable. This makes it possible for authenticated attackers, with contributor-level access and above, to bind blocks to arbitrary properties of the referenced objects. This exposes data such as the password hash and email address of any user selected in a user field, or the content and password of private or password-protected posts selected in a post field. Exploitation requires a user or post field to be registered on a post type the attacker can edit.

## References

- https://wpsec.com/vuln/WPSEC-2026-1300/
- https://plugins.svn.wordpress.org/meta-box/tags/5.15.3/
- https://wordpress.org/plugins/meta-box/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1300/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.