CVE-2026-15248 — Meta Box < 5.13.1 - Contributor+ Arbitrary Attachment Deletion via IDOR
The Meta Box WordPress plugin before 5.13.1 does not verify that a user is authorized to delete the supplied attachment before deleting it, allowing users with a low-privilege r…
Published: 2026-08-02 · CVSS: 5.5 · CVSS 3.1
The Meta Box WordPress plugin before 5.13.1 does not verify that a user is authorized to delete the supplied attachment before deleting it, allowing users with a low-privilege role such as Contributor to permanently delete arbitrary media attachments belonging to other users.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7