CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
What the vulnerability does
Missing Authorization vulnerability in MetaBox.Io Meta Box – WordPress Custom Fields Framework allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Meta Box – WordPress Custom Fields Framework: from n/a through 5.9.10.
Explanation of Vulnerability in Simple Terms
Meta Box versions up to 5.9.10 lack proper authorization checks on certain operations, allowing authenticated users with low privileges to read sensitive custom field data they should not access. The vulnerability requires a valid WordPress account but no special interaction. Confidentiality is significantly impacted; integrity is partially affected.
What an attacker can do
Read custom field data belonging to other users or posts without authorization.
Potential impact on your site
Sensitive custom field data (e.g., client info, pricing, internal notes) may be exposed to low-privilege users.
Conditions required to exploit
Attacker must have a valid WordPress user account with low privileges (e.g., subscriber or contributor role).
Key dates
External resources
Related vulnerabilities
