---
id: "CVE-2026-109700"
kind: "vulnerability"
aliases: ["CVE-2026-109700"]
title: "Meta Box WordPress plugin: missing authorization check exposes restricted actions"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["meta-box", "package", "self-hosted", "wordpress"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-10-20T16:17:00+00:00"
first_seen_at: "2026-10-23T21:57:20+00:00"
updated_at: "2026-10-25T03:55:35+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109700", "first_seen_at": "2026-10-23T21:57:20+00:00"}]
---

# Meta Box WordPress plugin: missing authorization check exposes restricted actions

Meta Box, a WordPress custom fields framework, has a missing authorization check that lets requests reach functions they should be blocked from. The sources describe incorrectly configured access control but do not say which data or actions an attacker can reach.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Meta Box plugin version in the WordPress admin under Plugins, or with `wp plugin get meta-box --field=version`
- unknown for any other check, the sources do not say which endpoint is affected

## Fix

- Update Meta Box to a version later than `5.15.2`, the last affected release listed by the source
- unknown for a patched version number, the sources do not say which release fixes it

## Timeline

- 2026-10-23T21:57:20+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-109700

## From the sources

Missing Authorization vulnerability in eLightUp Meta Box – WordPress Custom Fields Framework meta-box allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Meta Box – WordPress Custom Fields Framework: from n/a through 5.15.2.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_