CVE-2026-14488
The Meta Box AIO plugin for WordPress is vulnerable to a missing authorization flaw that lets attackers delete any post or page. The issue exists in all versions up to and including 3.8.0. It can be triggered by an unauthenticated user on any page that hosts a frontend submission form.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Meta Box AIO plugin for WordPress, versions 3.8.0 and earlier.
Real-world impact
An attacker can delete any post or page on the site by sending a crafted request, effectively removing content or disrupting the site’s operation.
Why this severity
The CVSS score of 9.1 reflects that the vulnerability is exploitable over the network without authentication, and it allows an attacker to cause a complete loss of data (high impact) and availability (high impact).
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources