{"id":"CVE-2026-109700","kind":"vulnerability","aliases":["CVE-2026-109700"],"related":[],"title":"Meta Box WordPress plugin: missing authorization check exposes restricted actions","description":"Missing Authorization vulnerability in eLightUp Meta Box – WordPress Custom Fields Framework meta-box allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Meta Box – WordPress Custom Fields Framework: from n/a through 5.15.2.","summary":"Meta Box, a WordPress custom fields framework, has a missing authorization check that lets requests reach functions they should be blocked from. The sources describe incorrectly configured access control but do not say which data or actions an attacker can reach.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["meta-box","package","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed Meta Box plugin version in the WordPress admin under Plugins, or with `wp plugin get meta-box --field=version`\n- unknown for any other check, the sources do not say which endpoint is affected","fix":"- Update Meta Box to a version later than `5.15.2`, the last affected release listed by the source\n- unknown for a patched version number, the sources do not say which release fixes it","status":"open","published_at":"2026-10-20T16:17:00+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-25T03:55:35+00:00","updated_at":"2026-10-25T03:55:35+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T03:55:35Z","model":"claude-haiku-5-5","output":{"fix":"- Update Meta Box to a version later than `5.15.2`, the last affected release listed by the source\n- unknown for a patched version number, the sources do not say which release fixes it","reach":"internet","title":"Meta Box WordPress plugin: missing authorization check exposes restricted actions","impact":"medium","summary":"Meta Box, a WordPress custom fields framework, has a missing authorization check that lets requests reach functions they should be blocked from. The sources describe incorrectly configured access control but do not say which data or actions an attacker can reach.","category":"package","nicknames":[],"who_cares":["wordpress","meta-box","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"unauthorized users may reach restricted plugin functions on the site","analyst_note":"Find the vulnerable endpoint, the required role, and the fixed version in the NVD entry or the plugin changelog.","how_to_check":"- Check the installed Meta Box plugin version in the WordPress admin under Plugins, or with `wp plugin get meta-box --field=version`\n- unknown for any other check, the sources do not say which endpoint is affected","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running Meta Box at version `5.15.2` or earlier are in scope. The sources do not say which roles or configurations make the flaw reachable, so treat any site with the plugin installed as potentially exposed. Sites that do not run the plugin can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000613,"input_tokens":3328,"output_tokens":560,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-109700':13A,16A '-2026':12A,15A '5.15.2':99C 'access':52B,84C 'action':10A,61B 'affect':89C 'allow':80C 'attack':63B 'author':6A,35B,67C 'block':45B 'box':2A,19B,26B,72C,79C,91C 'check':7A,36B 'configur':51B,83C 'control':53B,85C 'custom':29B,74C,93C 'cve':11A,14A 'data':59B 'describ':49B 'elightup':70C 'exploit':81C 'expos':8A 'field':30B,75C,94C 'framework':31B,76C,95C 'function':41B 'host':23B 'incorrect':50B,82C 'issu':88C 'let':38B 'levels.this':87C 'meta':1A,18B,25B,71C,78C,90C 'meta-box':17B,77C 'miss':5A,34B,66C 'n/a':97C 'packag':20B 'plugin':4A 'reach':40B,65B 'request':39B 'restrict':9A 'say':57B 'secur':86C 'self':22B 'self-host':21B 'sourc':48B 'vulner':68C 'wordpress':3A,24B,28B,73C,92C","nicknames":[],"mitigations":[],"who_affected":"Sites running Meta Box at version `5.15.2` or earlier are in scope. The sources do not say which roles or configurations make the flaw reachable, so treat any site with the plugin installed as potentially exposed. Sites that do not run the plugin can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T16:17:00+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-109700","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109700","severity":null,"published_at":"2026-10-20T16:17:00+00:00","modified_at":"2026-10-20T19:27:34+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}