A missing authorization flaw in the Meta Box AIO WordPress plugin (versions ≤ 3.8.0) lets unauthenticated attackers delete arbitrary posts and pages on any site hosting a frontend submission form.
What Is It
CVE-2026-14488 is a Missing Authorization vulnerability (CWE-862) in the MB Frontend Submission extension bundled with the Meta Box AIO plugin for WordPress. The extension's template_redirect dispatcher routes the mbfs_delete action through handle_request() without any capability or ownership check. Based on the advisory's description of the code path, the nonce verification that would otherwise block forged requests appears to live in check_ajax(), which is reportedly gated behind is_ajax(), false for template_redirect requests; meaning the nonce check would not run on this path and the protection would be bypassable.
An attacker supplies an arbitrary post ID via the rwmb_frontend_field_object_id GET parameter against any page hosting a frontend submission form. The advisory indicates the deletion succeeds regardless of whether the allow_delete option is enabled, though that behavior is described rather than independently confirmed here.
It carries a CVSS 3.1 base score of 9.1 (CRITICAL), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H.
Why It Matters
The attack is network-reachable, low-complexity, requires no privileges, and requires no user interaction; the maximum exploitability score of 3.9. Impact is high to both integrity and availability: an attacker can destroy site content at will, including pages they never had any relationship to. There is no confidentiality impact; this is a pure destruction primitive.
No CISA KEV entry was supplied for this CVE, so there is no confirmed evidence of active exploitation in the source material provided.
What's Vulnerable
- Vendor: Meta Box
- Product: Meta Box AIO (WordPress plugin)
- Affected versions: 0 through 3.8.0 inclusive (semver), where the MB Frontend Submission extension is in use
- Exposure condition: any page that renders a frontend submission form
Patch Status
The supplied NVD record has a status of Received (published 2026-07-29) and lists no fixed version. Administrators should consult the vendor changelog and Wordfence advisory below for remediation guidance. No required-action deadline was supplied, as no KEV entry accompanies this record.
Sources
- NVD, CVE-2026-14488 (source: [email protected])
- Meta Box AIO changelog; https://metabox.io/plugins/meta-box-aio/changelog/
- Wordfence Threat Intelligence; https://www.wordfence.com/threat-intel/vulnerabilities/id/e9506f84-3d33-48e0-8dce-d517e1a923e4?source=cve