Live › vulnerability › CVE-2026-109700
Go to dashboardMeta Box, a WordPress custom fields framework, has a missing authorization check that lets requests reach functions they should be blocked from. The sources describe incorrectly configured access control but do not say which data or actions an attacker can reach.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running Meta Box at version or earlier are in scope. The sources do not say which roles or configurations make the flaw reachable, so treat any site with the plugin installed as potentially exposed. Sites that do not run the plugin can skip it.
5.15.2No product ranges from the sources yet.
wp plugin get meta-box --field=version5.15.2, the last affected release listed by the sourceEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Missing Authorization vulnerability in eLightUp Meta Box – WordPress Custom Fields Framework meta-box allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Meta Box – WordPress Custom Fields Framework: from n/a through 5.15.2.
This page as .md · .json · in your agent: get_signal("CVE-2026-109700")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.