{"id":"CVE-2026-120836","kind":"vulnerability","aliases":["CVE-2026-120836"],"related":[],"title":"Meta Box WordPress plugin: missing authorization check exposes data to users","description":"Missing Authorization vulnerability in eLightUp Meta Box – WordPress Custom Fields Framework meta-box allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Meta Box – WordPress Custom Fields Framework: from n/a through 5.15.3.","summary":"Meta Box, a WordPress custom fields framework by eLightUp, has a missing authorization check that lets a user perform actions they should not be allowed to. The sources do not say exactly which data or actions an attacker reaches.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["meta-box","package","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed Meta Box plugin version in the WordPress admin under Plugins, or in `wp-content/plugins/meta-box/meta-box.php`.\n- Treat any version through `5.15.3` as affected.","fix":"- Move Meta Box to a version newer than `5.15.3`; the sources do not name the exact fixed release.","status":"open","published_at":"2026-11-07T18:17:18+00:00","first_seen_at":"2026-11-07T18:48:29+00:00","triaged_at":"2026-11-07T18:50:00+00:00","updated_at":"2026-11-07T18:50:00+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-07T18:50:00Z","model":"claude-haiku-5-5","output":{"fix":"- Move Meta Box to a version newer than `5.15.3`; the sources do not name the exact fixed release.","reach":"internet","title":"Meta Box WordPress plugin: missing authorization check exposes data to users","impact":"medium","summary":"Meta Box, a WordPress custom fields framework by eLightUp, has a missing authorization check that lets a user perform actions they should not be allowed to. The sources do not say exactly which data or actions an attacker reaches.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","meta-box"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unauthorized users perform restricted plugin actions on the site","analyst_note":"Confirm the affected roles and endpoints and the first fixed version from the NVD entry or the plugin vendor's changelog.","how_to_check":"- Check the installed Meta Box plugin version in the WordPress admin under Plugins, or in `wp-content/plugins/meta-box/meta-box.php`.\n- Treat any version through `5.15.3` as affected.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Meta Box WordPress plugin at version 5.15.3 or earlier are in scope. The sources do not describe which roles or endpoints are involved, so the exposure beyond the version range is unknown.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000694,"input_tokens":4236,"output_tokens":541,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-120836':14A,17A '-2026':13A,16A '5.15.3':95C 'access':80C 'action':42B,58B 'affect':85C 'allow':47B,76C 'attack':60B 'author':6A,35B,63C 'box':2A,20B,24B,68C,75C,87C 'check':7A,36B 'configur':79C 'control':81C 'custom':27B,70C,89C 'cve':12A,15A 'data':9A,56B 'elightup':31B,66C 'exact':54B 'exploit':77C 'expos':8A 'field':28B,71C,90C 'framework':29B,72C,91C 'incorrect':78C 'issu':84C 'let':38B 'levels.this':83C 'meta':1A,19B,23B,67C,74C,86C 'meta-box':18B,73C 'miss':5A,34B,62C 'n/a':93C 'packag':21B 'perform':41B 'plugin':4A 'reach':61B 'say':53B 'secur':82C 'sourc':50B 'user':11A,40B 'vulner':64C 'wordpress':3A,22B,26B,69C,88C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Meta Box WordPress plugin at version 5.15.3 or earlier are in scope. The sources do not describe which roles or endpoints are involved, so the exposure beyond the version range is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","metabox","package","wordpress"],"campaign_type":null,"search_a":"'-120836':14A,17A '-2026':13A,16A 'author':6A 'box':2A 'check':7A 'cve':12A,15A 'data':9A 'expos':8A 'meta':1A 'miss':5A 'plugin':4A 'user':11A 'wordpress':3A","search_b":"'action':42B,58B 'allow':47B 'attack':60B 'author':35B 'box':20B,24B 'check':36B 'custom':27B 'data':56B 'elightup':31B 'exact':54B 'field':28B 'framework':29B 'let':38B 'meta':19B,23B 'meta-box':18B 'miss':34B 'packag':21B 'perform':41B 'reach':61B 'say':53B 'sourc':50B 'user':40B 'wordpress':22B,26B","search_c":"'5.15.3':95C 'access':80C 'affect':85C 'allow':76C 'author':63C 'box':68C,75C,87C 'configur':79C 'control':81C 'custom':70C,89C 'elightup':66C 'exploit':77C 'field':71C,90C 'framework':72C,91C 'incorrect':78C 'issu':84C 'levels.this':83C 'meta':67C,74C,86C 'meta-box':73C 'miss':62C 'n/a':93C 'secur':82C 'vulner':64C 'wordpress':69C,88C","first_public_at":"2026-11-07T18:17:18+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120836","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120836","severity":null,"published_at":"2026-11-07T18:17:18+00:00","modified_at":"2026-11-07T18:17:18+00:00","first_seen_at":"2026-11-07T18:48:29+00:00","fetched_at":"2026-11-07T18:48:29+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}