CVE-2026-39468

MediumCVSS 6.8

Published: 15/06/2026(UTC)Updated: 25/10/2026(UTC)Translated: 17/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.22%

68th percentile - higher than 68% of all known CVEs

Summary

In Meta Box, a WordPress custom fields framework, there is a vulnerability allowing arbitrary file deletion by a contributor in versions up to 5.11.1.

Risk Assessment

An attacker could exploit this vulnerability to delete critical files from the system, potentially leading to data loss and application disruption.

Recommendation

It is recommended to update Meta Box to the latest version to mitigate the risk associated with this vulnerability.

Other vulnerabilities in Meta Box – WordPress Custom Fields Framework

CVE-2026-109700Medium
The WordPress Meta Box – WordPress Custom Fields Framework plugin through 5.15.2 contains a Missing Authorization vulnerability that allows exploitation of incorrectly configured access control security levels. This may allow unauthorized users to perform restricted actions.

Original NVD description (English source)

Contributor Arbitrary File Deletion in Meta Box – WordPress Custom Fields Framework <= 5.11.1 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS