Meta Box AIO frontend submission dispatcher permits unauthenticated arbitrary post deletion
Meta Box AIO through 3.8.0 is vulnerable to unauthenticated arbitrary post and page deletion in the bundled MB Frontend Submission extension. On any page containing a frontend submission form, the template_redirect dispatcher calls handle_request(), which accepts the mbfs_delete action and an attacker-controlled post ID in the rwmb_frontend_field_object_id GET parameter. handle_request() performs no ownership or capability check, while check_ajax() only verifies the nonce when is_ajax() is true; template_redirect requests are not AJAX, so the nonce check is skipped. The delete path is reachable even when allow_delete is disabled. Version 3.9.0 adds the missing frontend post-delete authorization check.
- Component
- Meta Box AIO
- Plugin slug
meta-box-aio- Affected
- <= 3.8.0
- Safe version
3.9.0- Published
- Jul 29, 2026
- Weakness
- CWE-862 — Missing Authorization
This CVE was published Jul 29, 2026 and is one of 3 known issues for this plugin.
Update, patch or deactivate.
Update Meta Box AIO to 3.9.0 or later. Review deleted posts and pages and web logs for unexpected mbfs_delete requests, restore unauthorized deletions from revisions or a trusted backup, and check whether deleted content exposed additional workflow or availability impact.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Meta Box AIO plugin for WordPress is vulnerable to Missing Authorization via the template_redirect dispatcher in the MB Frontend Submission extension in versions up to, and including, 3.8.0. This is due to the handle_request() function routing the mbfs_delete action without any capability or ownership check, and the nonce verification in check_ajax() being gated behind is_ajax() which is false for template_redirect requests, making it bypassable. This makes it possible for unauthenticated attackers to delete arbitrary posts and pages by supplying an attacker-controlled post ID via the rwmb_frontend_field_object_id GET parameter on any page that hosts a frontend submission form regardless of whether allow_delete is enabled.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H