CVE-2023-5426 in Post Meta Data Manager Plugin
Summary
by MITRE • 10/28/2023
The Post Meta Data Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the pmdm_wp_delete_user_meta, pmdm_wp_delete_term_meta, and pmdm_wp_ajax_delete_meta functions in versions up to, and including, 1.2.0. This makes it possible for unauthenticated attackers to delete user, term, and post meta belonging to arbitrary users.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 04/11/2026
The Post Meta Data Manager plugin for WordPress presents a critical security vulnerability that undermines the integrity of metadata management within WordPress environments. This flaw exists in versions up to and including 1.2.0 and stems from insufficient access control mechanisms that fail to validate user permissions before executing destructive operations. The vulnerability specifically affects three core functions: pmdm_wp_delete_user_meta, pmdm_wp_delete_term_meta, and pmdm_wp_ajax_delete_meta, which are designed to handle metadata deletion operations but lack proper capability checks that would normally restrict such actions to authenticated administrators.
The technical nature of this vulnerability aligns with CWE-285, which addresses insufficient authorization issues in software systems. Attackers can exploit this weakness without requiring authentication credentials to perform unauthorized metadata deletion operations across user, term, and post metadata. This represents a fundamental breakdown in WordPress's permission model where the plugin fails to verify that the requesting user possesses adequate privileges to modify or delete metadata belonging to other users. The absence of capability validation creates an attack surface that allows malicious actors to manipulate content metadata indiscriminately, potentially causing data corruption, information disclosure, or disruption of site functionality.
The operational impact of this vulnerability extends beyond simple data deletion, as metadata plays a crucial role in WordPress's content management and user experience. When attackers can delete user metadata, they may remove important user preferences, capabilities, or profile information that affects user access and site behavior. Similarly, term metadata deletion can impact taxonomy relationships and category structures, while post metadata deletion can remove critical content attributes such as featured images, custom fields, or SEO settings. This vulnerability essentially provides attackers with a mechanism to systematically dismantle content organization and user management features within WordPress installations.
From a threat modeling perspective, this vulnerability maps directly to ATT&CK technique T1485, which covers data destruction and the manipulation of data integrity. The attack vector leverages the plugin's lack of authentication checks to execute unauthorized operations against WordPress metadata systems. Organizations running affected versions of the Post Meta Data Manager plugin face significant risk of data compromise and system integrity violations. The vulnerability's exploitation requires minimal technical skill and no special privileges, making it particularly dangerous for widespread abuse.
Mitigation strategies should prioritize immediate plugin updates to versions that address the missing capability checks, as recommended by WordPress security protocols. Administrators should also implement network-level monitoring to detect unusual metadata deletion patterns and consider restricting plugin installations to authorized administrators only. Additional protective measures include regular security audits of installed plugins, implementation of automated patch management systems, and maintaining detailed backups of metadata structures. The vulnerability serves as a reminder of the critical importance of capability validation in web applications and demonstrates how seemingly minor access control oversights can create significant security risks in content management systems.