Description

The Meta Box AIO plugin for WordPress is vulnerable to Privilege Escalation to Administrator in versions up to, and including, 3.11.0. This is due to a chained flaw: the populate_via_query_string() function in the mb-frontend-submission component unconditionally overrides the form's target object_id from the GET parameter 'rwmb_frontend_field_object_id' without any authorization check, and Form::process() lacks the user_can_edit() check present in render(), allowing unauthenticated attackers to overwrite the post_content of any page with an arbitrary shortcode via wp_update_post(); the mb-user-profile component then directly trusts the 'role' and 'auto_login' shortcode attributes in the injected [mb_user_profile_register] shortcode with no role validation. This makes it possible for unauthenticated attackers to elevate their privileges to Administrator. The standalone plugins Meta Box Frontend Submission (in versions up to 4.5.6) and Meta Box User Profile (versions up to 3.11.0) are also affected.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-22T05:16:54.960Z",
  "pubdate": "2026-09-22T05:16:54.960Z",
  "executiveSummary": "The Meta Box AIO plugin, along with the Meta Box Frontend Submission and Meta Box User Profile plugins, contains a critical vulnerability allowing unauthenticated privilege escalation.\nThe vulnerability is caused by a chain of authorization flaws in the frontend submission and user profile management components.\nAn unauthenticated attacker can exploit this to overwrite post content with arbitrary shortcodes.\nBy injecting the [mb_user_profile_register] shortcode with manipulated attributes, an attacker can register a new account or elevate an existing session to Administrator privileges.\nThis flaw presents a severe risk to WordPress site integrity and security, as it bypasses standard access control mechanisms to provide full administrative control.\nExploitation requires no prior authentication and can be executed over the network by targeting exposed frontend submission forms.",
  "technicalDetails": "The vulnerability stems from an insecure implementation of object ID handling in the mb-frontend-submission component. Specifically, the function 'populate_via_query_string()' fails to perform authorization checks before overriding the form's 'object_id' using the 'rwmb_frontend_field_object_id' GET parameter. This allows an attacker to control the target of the form processing logic.\nFurther, the 'Form::process()' method lacks the 'user_can_edit()' check present in the 'render()' method. This discrepancy allows an unauthenticated user to trigger 'wp_update_post()' to modify the content of any post or page. An attacker can use this to inject a malicious [mb_user_profile_register] shortcode into any existing page content.\nThe exploitation chain continues within the 'mb-user-profile' component. This component processes the [mb_user_profile_register] shortcode by trusting the 'role' and 'auto_login' attributes provided within the shortcode parameters without performing any server-side validation or authorization checks to ensure the user is permitted to assign those specific roles.\nThe attack flow follows these steps: First, the attacker identifies a vulnerable frontend form. Second, the attacker sends a crafted request to the site containing the 'rwmb_frontend_field_object_id' parameter, targeting a specific page or post. Third, the attacker submits data that triggers the 'Form::process()' function, resulting in the injection of the [mb_user_profile_register] shortcode into the target post's content. Finally, the attacker visits the modified post, where the plugin executes the shortcode, creating an administrative account or elevating their current session based on the injected attributes.\nAffected products include Meta Box AIO (versions <= 3.11.0), Meta Box Frontend Submission (versions <= 4.5.6), and Meta Box User Profile (versions <= 3.11.0).\nPost-exploitation impact includes full administrative takeover of the WordPress instance, allowing the attacker to install arbitrary code, modify site configurations, and access sensitive data."
}