# Meta Box <= 5.15.3 - Authenticated (Contributor+) Missing Authorization to Sensitive Information Exposure via Object Field Ajax Query Arguments

- **ID:** WPSEC-2026-2697
- **Plugin:** Meta Box – A Framework for Dynamic Websites (`meta-box`), https://wordpress.org/plugins/meta-box/
- **Affected versions:** from 5.2.0 before 5.15.4
- **Fixed in:** 5.15.4 (Update to 5.15.4 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-07)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/meta-box
- **Fix released:** 2026-11-06
- **Published:** 2026-11-07
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2697/

## Description

The Meta Box plugin for WordPress is vulnerable to unauthorized data access via the post, taxonomy and user field Ajax search handlers (rwmb_get_posts, rwmb_get_terms, rwmb_get_users) in all versions up to, and including, 5.15.3, due to the handlers trusting the field definition sent in the request, including its query arguments, display field and search columns, while checking only a generic per-user 'query' nonce. Any user who can open an editing screen that shows a post, taxonomy or user field gets this nonce. This makes it possible for authenticated attackers with contributor-level access and above to run arbitrary user, term and post queries. They can list all users' login names, nicenames, URLs and registration dates, find or confirm users' e-mail addresses, list terms of any taxonomy, and infer post and user meta values through meta query conditions.

## References

- https://wpsec.com/vuln/WPSEC-2026-2697/
- https://plugins.svn.wordpress.org/meta-box/tags/5.15.4/
- https://wordpress.org/plugins/meta-box/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2697/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.