CVE-2024-43235 Overview
CVE-2024-43235 is a Missing Authorization vulnerability [CWE-862] in the Meta Box – WordPress Custom Fields Framework plugin developed by MetaBox.Io. The flaw stems from incorrectly configured access control security levels and affects all versions up to and including 5.9.10. Authenticated attackers with low privileges can exploit this weakness over the network to access functionality that should be restricted. The vulnerability carries a CVSS 3.1 score of 7.1, reflecting a high confidentiality impact and limited integrity impact. Meta Box is a widely deployed WordPress plugin used by developers to build custom fields, meta boxes, and content types.
Critical Impact
Authenticated attackers with low privileges can bypass access controls in Meta Box plugin versions through 5.9.10, exposing sensitive data and enabling unauthorized modifications on affected WordPress sites.
Affected Products
- MetaBox.Io Meta Box – WordPress Custom Fields Framework (all versions through 5.9.10)
- WordPress sites using the Meta Box plugin for custom field management
- Downstream extensions and themes depending on Meta Box functionality
Discovery Timeline
- 2024-11-01 - CVE-2024-43235 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-43235
Vulnerability Analysis
The vulnerability is a Broken Access Control weakness classified under CWE-862: Missing Authorization. Meta Box exposes functionality that fails to verify whether the requesting user holds the required capability or role. An attacker who has authenticated to WordPress with a low-privileged account, such as Subscriber or Contributor, can invoke restricted actions.
The attack surface is network-accessible through standard WordPress request handlers such as admin-ajax.php or REST endpoints exposed by the plugin. Successful exploitation returns high-value information to the attacker and permits limited modifications to plugin-managed data. Availability of the WordPress instance is not directly affected.
The EPSS score is 0.464% (percentile 37.97), indicating a moderate probability of exploitation attempts relative to other published CVEs. No public proof-of-concept has been observed in exploit repositories at time of writing.
Root Cause
The root cause is the absence of capability checks on privileged plugin actions. Meta Box handler functions do not call WordPress authorization primitives such as current_user_can() or verify nonces consistently before executing sensitive operations. Any authenticated session is therefore treated as sufficiently privileged.
Attack Vector
Exploitation requires network access to the WordPress site and a valid low-privileged account. The attacker sends crafted HTTP requests to Meta Box endpoints, invoking actions that should be limited to administrators or editors. See the Patchstack Vulnerability Advisory for endpoint-specific technical details.
// No verified public exploit code is available for CVE-2024-43235.
// Refer to the Patchstack advisory for endpoint and parameter specifics.
Detection Methods for CVE-2024-43235
Indicators of Compromise
- Unexpected POST requests to admin-ajax.php or Meta Box REST routes originating from low-privileged user sessions.
- WordPress audit log entries showing configuration or custom field changes performed by non-administrative accounts.
- Anomalous data exports or field enumeration activity from Subscriber or Contributor role accounts.
Detection Strategies
- Review WordPress application logs for authenticated requests targeting Meta Box action names without matching capability grants for the requesting user.
- Deploy a Web Application Firewall (WAF) rule set that validates role-to-action mappings for the Meta Box plugin.
- Correlate WordPress user role changes and content modifications with the originating account's expected privilege level.
Monitoring Recommendations
- Enable verbose access logging on the WordPress reverse proxy or web server and forward events to a centralized SIEM.
- Alert on repeated 200-status responses to sensitive Meta Box endpoints from the same low-privileged session.
- Track plugin version inventory across managed WordPress sites to identify installations still running versions at or below 5.9.10.
How to Mitigate CVE-2024-43235
Immediate Actions Required
- Update the Meta Box – WordPress Custom Fields Framework plugin to a version above 5.9.10 as published by MetaBox.Io.
- Audit WordPress user accounts and revoke any unnecessary low-privileged accounts that could be used to reach vulnerable endpoints.
- Rotate credentials for any accounts suspected of exposure and review recent plugin activity in audit logs.
Patch Information
MetaBox.Io has released a fixed version of the Meta Box plugin. Administrators should apply the patched release through the WordPress plugin manager or by deploying updated plugin files. Confirm the update through the Patchstack Vulnerability Advisory and the vendor's changelog.
Workarounds
- Restrict access to /wp-admin/admin-ajax.php and Meta Box REST routes at the WAF or reverse proxy for non-administrative user roles until the patch is deployed.
- Temporarily disable the Meta Box plugin on high-value WordPress instances if updating is not immediately possible.
- Enforce the principle of least privilege by removing self-registration and reviewing role assignments for all authenticated users.
# Update Meta Box via WP-CLI to the latest patched release
wp plugin update meta-box
wp plugin get meta-box --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
