Meta Box AIO Plugin on WordPress mb-frontend-submission/mb-user-profile Form::process rwmb_frontend_field_object_id privileges management

Summaryinfo

A vulnerability classified as critical has been found in Meta Box AIO Plugin. The affected element is the function Form::process of the component mb-frontend-submission/mb-user-profile. This manipulation of the argument rwmb_frontend_field_object_id causes privileges management. This vulnerability is tracked as CVE-2026-13355. The attack is possible to be carried out remotely. No exploit exists.

Detailsinfo

A vulnerability was found in Meta Box AIO Plugin (version now known). It has been declared as critical. Affected by this vulnerability is the function Form::process of the component mb-frontend-submission/mb-user-profile. The manipulation of the argument rwmb_frontend_field_object_id with an unknown input leads to a privileges management vulnerability. The CWE definition for the vulnerability is CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

The Meta Box AIO plugin for WordPress is vulnerable to Privilege Escalation to Administrator in versions up to, and including, 3.11.0. This is due to a chained flaw: the populate_via_query_string() function in the mb-frontend-submission component unconditionally overrides the form's target object_id from the GET parameter 'rwmb_frontend_field_object_id' without any authorization check, and Form::process() lacks the user_can_edit() check present in render(), allowing unauthenticated attackers to overwrite the post_content of any page with an arbitrary shortcode via wp_update_post(); the mb-user-profile component then directly trusts the 'role' and 'auto_login' shortcode attributes in the injected [mb_user_profile_register] shortcode with no role validation. This makes it possible for unauthenticated attackers to elevate their privileges to Administrator. The standalone plugins Meta Box Frontend Submission (in versions up to 4.5.6) and Meta Box User Profile (versions up to 3.11.0) are also affected.

The advisory is shared at wordfence.com. This vulnerability is known as CVE-2026-13355 since 06/25/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details are known, but no exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 09/22/2026). MITRE ATT&CK project uses the attack technique T1068 for this issue.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-84268). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• WordPress Plugin

Vendor

• Meta Box

Name

• AIO Plugin

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion