CVE-2026-15248 — Meta Box < 5.13.1 - Contributor+ Arbitrary Attachment Deletion via IDOR

CVE-2026-15248

Meta Box < 5.13.1 - Contributor+ Arbitrary Attachment Deletion via IDOR PUBLISHED

Description (CNA)

The Meta Box WordPress plugin before 5.13.1 does not verify that a user is authorized to delete the supplied attachment before deleting it, allowing users with a low-privilege role such as Contributor to permanently delete arbitrary media attachments belonging to other users.

Affected (CNA)

Vendor / product	Versions
Unknown / Meta Box	affected 0 before 5.13.1

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/a101136d-606f-4529-ae78-a4fff7724e2c/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.