External risk intelligence

Meta Box AIO Unauthenticated Arbitrary Post Deletion Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-14488

The vulnerability exists in a WordPress plugin designed to handle frontend submissions, which are typically exposed on public-facing web pages to allow user interaction. As these forms are intended to be accessible to site visitors over the internet, the vulnerable component is likely reachable in standard deployments.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in a widely used WordPress plugin that handles user submissions on public-facing websites. This flaw allows unauthenticated attackers to delete arbitrary posts and pages without needing any special access. The primary concern at this time is to confirm if this plugin is in use and if the affected functionality is exposed.

Unauthenticated attackers can delete website content.
This impacts public-facing WordPress sites using the plugin.
Confirm usage and exposure of the submission feature.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can delete arbitrary posts and pages on a WordPress site by exploiting a flaw in the Meta Box AIO plugin's frontend submission feature. The vulnerability lies in how the plugin handles deletion requests, specifically bypassing checks meant to prevent unauthorized actions. This allows an attacker to craft a request to delete content without needing any special privileges or even being logged in, as long as the site has a frontend submission form.

No authentication is required.
Triggered via a crafted GET request.
Risk: Arbitrary content deletion.

Live Threat

Current exploitation, exposure, and threat context

Unauthenticated attackers could delete any posts or pages on a WordPress site using the Meta Box AIO plugin. This is possible when the site has a frontend submission form, as the vulnerability allows for arbitrary post deletion without needing to be logged in or have specific permissions.

Arbitrary post and page deletion.
Unauthenticated access to delete functionality.
Content can be removed from the site.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability affects the Meta Box AIO WordPress plugin's frontend submission feature, allowing unauthenticated attackers to delete arbitrary posts and pages. Application owners and platform teams managing WordPress instances should prioritize identifying affected sites. The first practical step involves discovering all instances of the plugin, determining their reachability and business criticality, and then engaging with the accountable site owner to plan remediation based on the assessed risk.

WordPress application owners
Verify plugin instances and reachability
Plan risk-based remediation actions

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Meta Box AIO plugin?

Meta Box AIO is a suite of extensions for WordPress that simplifies creating custom post types, fields, and frontend submission forms. It allows developers to build complex content management features, such as user-submitted posts or directory listings, directly within the WordPress dashboard and display them on the site's public-facing pages.

How does CWE-862 apply to CVE-2026-14488?

This vulnerability is classified as CWE-862, which refers to Missing Authorization. In this specific case, the plugin fails to verify if a user has permission or ownership rights before processing a request to delete content. Because the code lacks these checks, it incorrectly trusts incoming requests to remove site data.

Do I need to be logged in to trigger this vulnerability?

No. The flaw allows unauthenticated attackers to trigger the deletion process remotely. The vulnerability exists specifically within the plugin's frontend submission handling. It is not triggered if your site does not host a frontend submission form, as the specific code path that mismanages the deletion request requires such a form to be present.

Is my site at risk according to Halo Surface Signal?

Yes, if you use this plugin, your site is likely reachable. Halo Surface Signal identifies this as an external risk because Meta Box AIO is designed to handle frontend submissions, which are typically placed on public-facing web pages to allow user interaction. If your site hosts these forms, the vulnerable component is likely exposed to the internet.

What should I do if I run Meta Box AIO?

First, audit your WordPress installations to identify where Meta Box AIO is currently active. Determine if those sites use the affected frontend submission functionality. Once identified, prioritize these instances and coordinate with your team to apply the necessary plugin updates or remove the submission forms until you have remediated the vulnerability.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.