Meta Box <= 5.15.3 - Authenticated (Contributor+) Missing Authorization to Sensitive Information Exposure via Object Field Ajax Query Arguments
- ID
- WPSEC-2026-2697
- Plugin
- Meta Box – A Framework for Dynamic Websites (meta-box)
- Affected
- from 5.2.0 before 5.15.4
- Remediation
- Update to 5.15.4 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-07
- Attack surface
- Meta Box on WPSec AttackSurface
- Fix released
- Published
Description
The Meta Box plugin for WordPress is vulnerable to unauthorized data access via the post, taxonomy and user field Ajax search handlers (rwmb_get_posts, rwmb_get_terms, rwmb_get_users) in all versions up to, and including, 5.15.3, due to the handlers trusting the field definition sent in the request, including its query arguments, display field and search columns, while checking only a generic per-user 'query' nonce. Any user who can open an editing screen that shows a post, taxonomy or user field gets this nonce. This makes it possible for authenticated attackers with contributor-level access and above to run arbitrary user, term and post queries. They can list all users' login names, nicenames, URLs and registration dates, find or confirm users' e-mail addresses, list terms of any taxonomy, and infer post and user meta values through meta query conditions.
References
- https://wpsec.com/vuln/WPSEC-2026-2697/
- https://plugins.svn.wordpress.org/meta-box/tags/5.15.4/
- https://wordpress.org/plugins/meta-box/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS