Meta Box AIO

No attacker login is required. An attacker can cross a permission boundary and gain privileges beyond those intended for the caller. The role-changing operation, target privilege and endpoint are undisclosed. The supplied vector reports high confidentiality impact, high integrity impact, high availability impact. The vector requires no victim interaction. Affected versions: <= 3.7.1. No fixed release is confirmed. The current official release could not be verified.

Unauthenticated input in rwmb_frontend_field_object_id overrides the target object_id in populate_via_query_string(). Form::process() omits the user_can_edit() check used by rendering, so wp_update_post() can overwrite another page with an attacker-selected shortcode. The mb-user-profile component then trusts role and auto_login attributes in mb_user_profile_register, allowing administrator registration. The export covers Meta Box AIO through 3.11.0, standalone Frontend Submission through 4.5.6, and User Profile through 3.11.0. The chain requires the relevant frontend submission and registration components; the exact submission route is not disclosed. The structured affected range refers to standalone Frontend Submission through 4.5.6; the description separately lists the AIO and User Profile ranges above. Confirmed remediation: 3.12.0 (Meta Box AIO only).

Meta Box AIO through 3.8.0 is vulnerable to unauthenticated arbitrary post and page deletion in the bundled MB Frontend Submission extension. On any page containing a frontend submission form, the template_redirect dispatcher calls handle_request(), which accepts the mbfs_delete action and an attacker-controlled post ID in the rwmb_frontend_field_object_id GET parameter. handle_request() performs no ownership or capability check, while check_ajax() only verifies the nonce when is_ajax() is true; template_redirect requests are not AJAX, so the nonce check is skipped. The delete path is reachable even when allow_delete is disabled. Version 3.9.0 adds the missing frontend post-delete authorization check.