CVE-2026-109700

MediumCVSS 6.5

Published: 20/10/2026(UTC)Updated: 20/10/2026(UTC)Translated: 20/10/2026(UTC)NVD NIST

Summary

The WordPress Meta Box – WordPress Custom Fields Framework plugin through 5.15.2 contains a Missing Authorization vulnerability that allows exploitation of incorrectly configured access control security levels. This may allow unauthorized users to perform restricted actions.

Risk Assessment

An unauthorized user may gain access to functions or data they should not be permitted to use. The risk affects WordPress sites with the vulnerable Meta Box version installed.

Recommendation

Update the Meta Box plugin to the latest version (above 5.15.2). Verify user permission configuration.

Other vulnerabilities in Meta Box – WordPress Custom Fields Framework

CVE-2026-39468Medium
In Meta Box, a WordPress custom fields framework, there is a vulnerability allowing arbitrary file deletion by a contributor in versions up to 5.11.1.

Original NVD description (English source)

Missing Authorization vulnerability in eLightUp Meta Box – WordPress Custom Fields Framework meta-box allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Meta Box – WordPress Custom Fields Framework: from n/a through 5.15.2.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS