Meta Box form-target substitution can create an administrator account
Unauthenticated input in rwmb_frontend_field_object_id overrides the target object_id in populate_via_query_string(). Form::process() omits the user_can_edit() check used by rendering, so wp_update_post() can overwrite another page with an attacker-selected shortcode. The mb-user-profile component then trusts role and auto_login attributes in mb_user_profile_register, allowing administrator registration. The export covers Meta Box AIO through 3.11.0, standalone Frontend Submission through 4.5.6, and User Profile through 3.11.0. The chain requires the relevant frontend submission and registration components; the exact submission route is not disclosed. The structured affected range refers to standalone Frontend Submission through 4.5.6; the description separately lists the AIO and User Profile ranges above. Confirmed remediation: 3.12.0 (Meta Box AIO only).
- Component
- Meta Box Frontend Submission
- Plugin slug
meta-box-aio- Affected
- <= 4.5.6
- Safe version
3.12.0 (Meta Box AIO only)- Published
- Sep 22, 2026
This CVE was published Sep 22, 2026 and is one of 3 known issues for this plugin.
Update, patch or deactivate.
Confirmed fixed release: 3.12.0 (Meta Box AIO only). AIO 3.12.0 adds the missing frontend Form::process() authorization check. This confirms the AIO fix, not a fixed version for the standalone extensions. Official changelog: https://metabox.io/plugins/meta-box-aio/changelog/ . Disable the affected public submission/registration flow until patched. Bind form targets to server-side authorization during processing, recheck edit permission for the actual object, and allow only explicitly permitted registration roles; never trust role or auto-login decisions supplied by shortcode content. The 3.12.0 recommendation is for AIO only; standalone Frontend Submission and User Profile fixed versions remain unconfirmed.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Meta Box AIO plugin for WordPress is vulnerable to Privilege Escalation to Administrator in versions up to, and including, 3.11.0. This is due to a chained flaw: the populate_via_query_string() function in the mb-frontend-submission component unconditionally overrides the form's target object_id from the GET parameter 'rwmb_frontend_field_object_id' without any authorization check, and Form::process() lacks the user_can_edit() check present in render(), allowing unauthenticated attackers to overwrite the post_content of any page with an arbitrary shortcode via wp_update_post(); the mb-user-profile component then directly trusts the 'role' and 'auto_login' shortcode attributes in the injected [mb_user_profile_register] shortcode with no role validation. This makes it possible for unauthenticated attackers to elevate their privileges to Administrator. The standalone plugins Meta Box Frontend Submission (in versions up to 4.5.6) and Meta Box User Profile (versions up to 3.11.0) are also affected.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H