PT-2026-23832 · WordPress · Meta Box

Jonghwan Shin · Published 2026-03-07 · Updated 2026-03-12 · CVE-2025-14675

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Meta Box versions prior to 5.11.2

Description The Meta Box plugin for WordPress is susceptible to arbitrary file deletion. This is due to inadequate file path validation within the ajax delete file function. Authenticated attackers possessing Contributor-level access or higher can delete arbitrary files on the server. Deletion of specific files, such as wp-config.php, could lead to remote code execution.

Recommendations Update Meta Box to version 5.11.2 or later.

Fix

RCE

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-14675

GHSA-M4Q3-832V-44J6

Affected Products

Meta Box

References · 15

• https://osv.dev/vulnerability/CVE-2025-14675 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-14675 · Security Note
• https://osv.dev/vulnerability/GHSA-m4q3-832v-44j6 · Vendor Advisory
• https://github.com/wpmetabox/meta-box/commit/08c6511607b9cc9fe8d0de7a7e91c9d5d415f831 · Note
• https://github.com/wpmetabox/meta-box · Note
• https://github.com/wpmetabox/meta-box/pull/1654 · Note
• https://plugins.trac.wordpress.org/changeset/3475210/meta-box#file3 · Note
• https://t.me/CVEtracker/46704 · Telegram Post
• https://plugins.trac.wordpress.org/browser/meta-box/tags/5.11.0/inc/fields/file.php#L54 · Note
• https://twitter.com/CVEnew/status/2030339339499307159 · Twitter Post
• https://plugins.trac.wordpress.org/browser/meta-box/tags/5.11.0/inc/fields/file.php#L30 · Note
• https://t.me/cveNotify/154574 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/036467de-95bb-4bfd-9522-df8dc17f3102?source=cve · Note
• https://twitter.com/cracbot/status/2032049016859738468 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2030265562496946449 · Twitter Post