PT-2026-23832 · WordPress · Meta Box
Jonghwan Shin
·
Publicado
2026-03-07
·
Atualizado
2026-03-12
·
CVE-2025-14675
CVSS v3.1
7.2
Alta
| Vetor | AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Meta Box versions prior to 5.11.2
Description
The Meta Box plugin for WordPress is susceptible to arbitrary file deletion. This is due to inadequate file path validation within the
ajax delete file function. Authenticated attackers possessing Contributor-level access or higher can delete arbitrary files on the server. Deletion of specific files, such as wp-config.php, could lead to remote code execution.Recommendations
Update Meta Box to version 5.11.2 or later.
Correção
RCE
Path traversal
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Meta Box