CVE-2026-13355

CVE-2026-13355 — Meta Box AIO Unauthenticated Administrator Privilege Escalation Python 3 proof-of-concept scanner and exploit for CVE-2026-13355 in the WordPress bundle Meta Box AIO and related MB Frontend Submission / MB User Profile extensions. | ---|--- Platform| WordPress plugin Component|...

CVE-2026-39761

Unauthenticated Privilege Escalation in Meta Box AIO = 3.7.1 versions...

CVE-2026-39761 WordPress Meta Box AIO plugin <= 3.7.1 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in Meta Box AIO = 3.7.1 versions...

CVE-2026-39761

The Meta Box AIO plugin for WordPress, in versions

EUVD-2026-93269

Unauthenticated Privilege Escalation in Meta Box AIO = 3.7.1 versions...

CVE-2026-39761 WordPress Meta Box AIO plugin <= 3.7.1 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in Meta Box AIO = 3.7.1 versions...

CVE-2026-39761: Incorrect Privilege Assignment

Unauthenticated Privilege Escalation in Meta Box AIO = 3.7.1 versions...

PT-2026-106434

Name of the Vulnerable Software and Affected Versions Meta Box AIO versions prior to 3.7.2 Description An issue allows unauthenticated users to perform privilege escalation. Recommendations Update to a version newer than 3.7.1...

WordPress Meta Box AIO plugin <= 3.7.1 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by wackydawg in WordPress Plugin Meta Box AIO versions = 3.7.1...

Exploit for CVE-2026-13355

CVE-2026-13355 — Meta Box AIO Unauthenticated Administrator Pr...

CVE-2026-13355

The Meta Box AIO plugin for WordPress is vulnerable to Privilege Escalation to Administrator in versions up to, and including, 3.11.0. This is due to a chained flaw: the populateviaquerystring function in the mb-frontend-submission component unconditionally overrides the form's target objectid fr...

CVE-2026-13355

The Meta Box AIO WordPress plugin (versions ≤ 3.11.0 ) is vulnerable to unauthenticated Privilege Escalation to Administrator due to a chained flaw in its bundled components. The mb-frontend-submission component lacks authorization checks in the populate_via_query_string() function, allowing atta...

CVE-2026-13355 Meta Box AIO <= 3.11.0 And Standalone Plugin Extensions - Unauthenticated Privilege Escalation to Administrator to 'rwmb_frontend_field_object_id' Parameter

The Meta Box AIO plugin for WordPress is vulnerable to Privilege Escalation to Administrator in versions up to, and including, 3.11.0. This is due to a chained flaw: the populateviaquerystring function in the mb-frontend-submission component unconditionally overrides the form's target objectid fr...

EUVD-2026-84268

The Meta Box AIO plugin for WordPress is vulnerable to Privilege Escalation to Administrator in versions up to, and including, 3.11.0. This is due to a chained flaw: the populateviaquerystring function in the mb-frontend-submission component unconditionally overrides the form's target objectid fr...

CVE-2026-13355 Meta Box AIO <= 3.11.0 And Standalone Plugin Extensions - Unauthenticated Privilege Escalation to Administrator to 'rwmb_frontend_field_object_id' Parameter

The Meta Box AIO plugin for WordPress is vulnerable to Privilege Escalation to Administrator in versions up to, and including, 3.11.0. This is due to a chained flaw: the populateviaquerystring function in the mb-frontend-submission component unconditionally overrides the form's target objectid fr...

CVE-2026-13355: Improper Privilege Management

The Meta Box AIO plugin for WordPress is vulnerable to Privilege Escalation to Administrator in versions up to, and including, 3.11.0. This is due to a chained flaw: the populateviaquerystring function in the mb-frontend-submission component unconditionally overrides the form's target objectid fr...

PT-2026-96644

Name of the Vulnerable Software and Affected Versions Meta Box AIO versions prior to 3.11.1 Meta Box Frontend Submission versions prior to 4.5.7 Meta Box User Profile versions prior to 3.11.1 Description A chained flaw allows unauthenticated attackers to escalate privileges to Administrator. The...

WordPress Meta Box AIO plugin <= 3.11.0 - Unauthenticated Privilege Escalation to Administrator to 'rwmb_frontend_field_object_id' Parameter vulnerability

Unauthenticated Privilege Escalation to Administrator to 'rwmbfrontendfieldobjectid' Parameter vulnerability discovered by h0xilo in WordPress Plugin Meta Box AIO versions = 3.11.0...

WordPress Meta Box User Profile plugin < 2.6.0 - Unauthenticated Privilege Escalation to Administrator to 'rwmb_frontend_field_object_id' Parameter vulnerability

Unauthenticated Privilege Escalation to Administrator to 'rwmbfrontendfieldobjectid' Parameter vulnerability discovered by h0xilo in WordPress Plugin Meta Box User Profile versions 2.6.0...

WordPress Meta Box AIO plugin <= 3.8.0 - Missing Authorization to Unauthenticated Arbitrary Post Deletion vulnerability

Missing Authorization to Unauthenticated Arbitrary Post Deletion vulnerability discovered by Austin Ginder in WordPress Plugin Meta Box AIO versions = 3.8.0...