CVE-2026-15248

Meta Box < 5.13.1 - Contributor+ Arbitrary Attachment Deletion via IDOR

The Meta Box WordPress plugin before 5.13.1 does not verify that a user is authorized to delete the supplied attachment before deleting it, allowing users with a low-privilege role such as Contributor to permanently delete arbitrary media attachments belonging to other users.

Affected

Meta Box

CVSS v3.1 CNA

5.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L

EPSS

0.38% chance of exploitation in the next 30 days, 30th percentile

Published

2026-08-02

Updated

2026-08-05

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/a101136d-606f-4529-ae78-a4fff7724e2c/

References

• CVE Record
• NVD entry