CVE-2026-109700 Overview
CVE-2026-109700 is a Missing Authorization vulnerability [CWE-862] in the eLightUp Meta Box – WordPress Custom Fields Framework plugin. The flaw affects all plugin versions up to and including 5.15.2. The vulnerability allows authenticated users with low privileges to exploit incorrectly configured access control security levels and read sensitive data they should not be able to access.
Critical Impact
Authenticated attackers with low-level privileges can bypass access controls to read confidential data managed by the Meta Box plugin on affected WordPress sites.
Affected Products
- eLightUp Meta Box – WordPress Custom Fields Framework plugin
- All versions from n/a through 5.15.2
- WordPress sites with the vulnerable Meta Box plugin installed
Discovery Timeline
- 2026-10-20 - CVE CVE-2026-109700 published to NVD
- 2026-10-20 - Last updated in NVD database
Technical Details for CVE-2026-109700
Vulnerability Analysis
The vulnerability is a Broken Access Control issue in the Meta Box plugin for WordPress. The plugin fails to verify that the requesting user is authorized to perform specific actions or access specific data. Attackers who hold any authenticated session on the site can exploit the misconfigured authorization checks over the network with low attack complexity. Exploitation does not require user interaction. The impact is confined to confidentiality; integrity and availability of the affected site are not directly degraded.
Root Cause
The root cause is Missing Authorization [CWE-862]. One or more plugin endpoints or handlers do not enforce capability checks that confirm whether the calling user has permission to retrieve the requested resource. According to the Patchstack advisory, the issue is categorized as a broken access control weakness affecting plugin functionality through version 5.15.2.
Attack Vector
The attack vector is network-based and requires low-level authenticated access to the target WordPress instance. An attacker with a subscriber-equivalent account can send crafted requests to the vulnerable plugin endpoints and retrieve data intended for higher-privileged roles. Because the plugin is widely used as a custom fields framework, the exposed data may include post meta, custom field values, and configuration intended only for administrators or editors.
See the Patchstack Meta Box Vulnerability advisory for the vendor-coordinated technical reference.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-109700
Indicators of Compromise
- Unexpected HTTP requests from low-privilege user sessions targeting Meta Box plugin endpoints under /wp-admin/admin-ajax.php or REST routes.
- Access log entries showing subscriber or contributor accounts retrieving responses that contain custom field or post meta data.
- Spikes in authenticated requests to plugin-specific actions correlated with the meta-box plugin slug.
Detection Strategies
- Audit WordPress access logs for authenticated requests to Meta Box AJAX actions and REST endpoints originating from non-administrative roles.
- Review the plugin version in wp-content/plugins/meta-box/meta-box.php and flag installations at or below 5.15.2.
- Correlate authentication events with subsequent sensitive data responses to identify anomalous access patterns.
Monitoring Recommendations
- Enable verbose WordPress audit logging to capture user capability checks and REST API calls.
- Monitor outbound responses from Meta Box endpoints for unexpected data volume or content classifications.
- Alert on new or dormant low-privilege accounts that begin issuing requests to custom field management endpoints.
How to Mitigate CVE-2026-109700
Immediate Actions Required
- Inventory all WordPress sites and identify installations of the Meta Box plugin at version 5.15.2 or earlier.
- Update the Meta Box plugin to the latest version released by eLightUp that addresses the broken access control issue.
- Review user accounts and remove or downgrade any unnecessary low-privilege accounts that could be used as a foothold.
Patch Information
At the time of publication, the Patchstack advisory confirms the vulnerability affects Meta Box through 5.15.2. Administrators should consult the Patchstack Meta Box Vulnerability advisory and the official plugin changelog for the fixed version and apply the update across all WordPress environments.
Workarounds
- Restrict registration and disable self-service account creation to reduce the pool of authenticated attackers.
- Deploy a web application firewall rule that blocks requests to vulnerable Meta Box endpoints from non-administrative roles until patching is complete.
- Temporarily deactivate the Meta Box plugin on sites where the custom fields functionality is not business-critical.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
