github.com
https://github.com/wpmetabox/meta-box CVE-2025-14675
HIGHNuclei
Meta Box <= 5.11.1 - Authenticated (Contributor+) Arbitrary File Deletion
Record summary
CVE-2025-14675 has a selected CVSS score of 7.2 (high); EIP currently links 1 Nuclei template.
Description
The Meta Box plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'ajax_delete_file' function in all versions up to, and including, 5.11.1. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Description source: CVE List
Exploitation context
Available material
- Nuclei templates
- 1
CISA SSVC decision
ExploitationNone
AutomatableNo
Technical impactTotal
CISA Coordinator · SSVC 2.0.3 · Evaluated Mar 9, 2026 · Source: CVE List
Affected products and versions
2| Product | Source | Version range | Status |
|---|---|---|---|
Meta BoxBrowse metabox / Meta BoxDefault status: unaffected | CVE List | Through 5.11.1 | affected |
wpmetabox/meta-boxBrowse Packagist / wpmetabox/meta-box | GitHub Advisory | Before 5.11.2 · Fixed in 5.11.2 | affected |
Nuclei templates
1ProjectDiscoveryHIGHMeta Box <= 5.11.1 - Arbitrary File DeletionTemplate ID: CVE-2026-39468CVSS 7.2
The Meta Box plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the ajax_delete_file function. This makes it possible for authenticated attackers with Contributor-level access and above to delete arbitrary files on the server.
Impact
Authenticated attackers can delete arbitrary files such as wp-config.php, which can lead to remote code execution in the right configuration.
Remediation
Update Meta Box to version 5.11.2 or later.
WeaknessesCWE-22
Authorsiamatownboy
Template tagscvecve2026wordpresswpwp-pluginmeta-boxfile-deletionpassive
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
https://www.wordfence.com/threat-intel/vulnerabilities/id/036467de-95bb-4bfd-9522-df8dc17f3102?source=cve https://nvd.nist.gov/vuln/detail/CVE-2025-14675
Source: ProjectDiscovery
References
7github.com
https://github.com/wpmetabox/meta-box/commit/08c6511607b9cc9fe8d0de7a7e91c9d5d415f831 github.com
https://github.com/wpmetabox/meta-box/pull/1654 nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2025-14675 plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/meta-box/tags/5.11.0/inc/fields/file.php plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/changeset/3475210/meta-box wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/036467de-95bb-4bfd-9522-df8dc17f3102?source=cve