SYS::ONLINE
Wasteland.
Briefs1598
Issues21
SinceFeb 2026
LIVE
⚡ Active KEV CVE-2026-14488 2026-07-29

CVE-2026-14488: Unauthenticated Post Deletion in Meta Box AIO for WordPress

"A missing authorization flaw in the Meta Box AIO WordPress plugin (versions ≤ 3.8.0) lets unauthenticated attackers delete arbitrary posts and pages on any site hosting a frontend submission form."

A missing authorization flaw in the Meta Box AIO WordPress plugin (versions ≤ 3.8.0) lets unauthenticated attackers delete arbitrary posts and pages on any site hosting a frontend submission form.

What Is It

CVE-2026-14488 is a Missing Authorization vulnerability (CWE-862) in the MB Frontend Submission extension bundled with the Meta Box AIO plugin for WordPress. The extension's template_redirect dispatcher routes the mbfs_delete action through handle_request() without any capability or ownership check. Based on the advisory's description of the code path, the nonce verification that would otherwise block forged requests appears to live in check_ajax(), which is reportedly gated behind is_ajax(), false for template_redirect requests; meaning the nonce check would not run on this path and the protection would be bypassable.

An attacker supplies an arbitrary post ID via the rwmb_frontend_field_object_id GET parameter against any page hosting a frontend submission form. The advisory indicates the deletion succeeds regardless of whether the allow_delete option is enabled, though that behavior is described rather than independently confirmed here.

It carries a CVSS 3.1 base score of 9.1 (CRITICAL), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H.

Why It Matters

The attack is network-reachable, low-complexity, requires no privileges, and requires no user interaction; the maximum exploitability score of 3.9. Impact is high to both integrity and availability: an attacker can destroy site content at will, including pages they never had any relationship to. There is no confidentiality impact; this is a pure destruction primitive.

No CISA KEV entry was supplied for this CVE, so there is no confirmed evidence of active exploitation in the source material provided.

What's Vulnerable

Patch Status

The supplied NVD record has a status of Received (published 2026-07-29) and lists no fixed version. Administrators should consult the vendor changelog and Wordfence advisory below for remediation guidance. No required-action deadline was supplied, as no KEV entry accompanies this record.

Sources