CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
The Meta Box plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'ajax_delete_file' function in all versions up to, and including, 5.11.1. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Explanation of Vulnerability in Simple Terms
Meta Box versions up to 5.11.1 contain a path traversal vulnerability that allows high-privilege users to read or write arbitrary files on the server. An attacker with admin or equivalent access can bypass file restrictions and access sensitive data outside the intended directory structure. This affects file handling operations within the plugin.
What an attacker can do
Read or write arbitrary files on the server outside intended directories.
Potential impact on your site
A compromised admin account can expose sensitive files or modify critical site files.
Conditions required to exploit
Attacker must have high-level privileges (admin or equivalent role) on the site.
Key dates
External resources
