CVE-2026-13355

The Meta Box AIO WordPress plugin (versions ≤ 3.11.0 ) is vulnerable to unauthenticated Privilege Escalation to Administrator due to a chained flaw in its bundled components. The mb-frontend-submission component lacks authorization checks in the populate_via_query_string() function, allowing atta...