Meta Box lets Contributors delete other users' media
Meta Box before 5.13.1 does not verify that the requester is authorized to delete the supplied attachment. A low-privilege user such as a Contributor can select media belonging to another user and permanently delete it.
- Component
- Meta Box
- Plugin slug
meta-box- Affected
- < 5.13.1
- Safe version
5.13.1- Published
- Aug 02, 2026
- Weakness
- CWE-862 — Missing Authorization
This CVE was published Aug 02, 2026 and is one of 8 known issues for this plugin.
Update, patch or deactivate.
Update Meta Box to 5.13.1 or later. Review media deletions by Contributors, restore missing attachments from trusted backups and repair posts that referenced deleted files.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Meta Box WordPress plugin before 5.13.1 does not verify that a user is authorized to delete the supplied attachment before deleting it, allowing users with a low-privilege role such as Contributor to permanently delete arbitrary media attachments belonging to other users.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L