CVE-2026-14488

The Meta Box AIO plugin for WordPress is vulnerable to Missing Authorization via the templateredirect dispatcher in the MB Frontend Submission extension in versions up to, and including, 3.8.0. This is due to the handlerequest function routing the mbfsdelete action without any capability or...

CVE-2026-14488

CVE-2026-14488 affects the Meta Box AIO WordPress plugin (MB Frontend Submission extension) up to version 3.8.0. The vulnerability stems from handle_request() routing the mbfs_delete action without capability/ownership checks, and nonce verification in check_ajax() being gated behind is_ajax(), w...

CVE-2026-14488 Meta Box AIO <= 3.8.0 - Missing Authorization to Unauthenticated Arbitrary Post Deletion via 'rwmb_frontend_field_object_id' Parameter

The Meta Box AIO plugin for WordPress is vulnerable to Missing Authorization via the templateredirect dispatcher in the MB Frontend Submission extension in versions up to, and including, 3.8.0. This is due to the handlerequest function routing the mbfsdelete action without any capability or...