CVE-2026-13355

🗓️ 22 Sep 2026 04:27:37Reported by WordfenceType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 56 Views🌐 WEB

Unauthenticated Privilege Escalation to Administrator in Meta Box AIO up to 3.11.0.

Reporter	Title	Published	Views	Family All 12
GithubExploit	Exploit for CVE-2026-13355	22 Sep 202606:08	–	githubexploit
Circl	CVE-2026-13355	22 Sep 202605:00	–	circl
Cvelist	CVE-2026-13355 Meta Box AIO <= 3.11.0 And Standalone Plugin Extensions - Unauthenticated Privilege Escalation to Administrator to 'rwmb_frontend_field_object_id' Parameter	22 Sep 202604:27	–	cvelist
EUVD	EUVD-2026-84268	22 Sep 202604:27	–	euvd
Kitploit	CVE-2026-13355	6 Oct 202609:04	–	kitploit
NVD	CVE-2026-13355	22 Sep 202605:16	–	nvd
Patchstack	WordPress Meta Box Frontend Submission <= 4.6.0 - Unauthenticated Privilege Escalation to Administrator to 'rwmb_frontend_field_object_id' Parameter vulnerability	21 Sep 202616:42	–	patchstack
Patchstack	WordPress Meta Box User Profile plugin < 2.6.0 - Unauthenticated Privilege Escalation to Administrator to 'rwmb_frontend_field_object_id' Parameter vulnerability	21 Sep 202616:42	–	patchstack
Patchstack	WordPress Meta Box AIO plugin <= 3.11.0 - Unauthenticated Privilege Escalation to Administrator to 'rwmb_frontend_field_object_id' Parameter vulnerability	21 Sep 202616:42	–	patchstack
Positive Technologies	PT-2026-96644	22 Sep 202600:00	–	ptsecurity

Vulners

Node

metabox meta_box_frontend_submissionRange≤4.5.6wordpress

[
  {
    "vendor": "Meta Box",
    "product": "Meta Box Frontend Submission",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "4.5.6",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
metabox	www.metabox.io/plugins/meta-box-aio/changelog/
metabox	www.metabox.io/changelog/
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/3b7b6e7e-b944-45f8-a6d8-bfd859bec0d1

Parameter	Position	Path	Description	CWE
rwmb_frontend_field_object_id	query param	/contact/	Unauthenticated override of the form target object_id via rwmb_frontend_field_object_id in the query string.	CWE-269
post_content	request body	/contact/	POST to mbfs form to overwrite post_content with a shortcode payload for privilege escalation.	CWE-269

22 Sep 2026 19:04Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.19.8

EPSS0.00442

SSVC

CWE-269