CVE-2026-13355: Meta Box AIO Privilege Escalation Flaw

CVE-2026-13355 Overview

CVE-2026-13355 is a privilege escalation vulnerability in the Meta Box AIO plugin for WordPress affecting versions up to and including 3.11.0. Unauthenticated attackers can elevate privileges to Administrator by chaining a missing authorization check in the frontend submission component with unsafe handling of the [mb_user_profile_register] shortcode. The standalone Meta Box Frontend Submission (up to 4.5.6) and Meta Box User Profile (up to 3.11.0) plugins are also affected. The flaw is categorized under [CWE-269] Improper Privilege Management.

Critical Impact
Unauthenticated attackers can overwrite the post_content of any page and gain Administrator access to the WordPress site.

Affected Products

Meta Box AIO plugin for WordPress (versions up to and including 3.11.0)
Meta Box Frontend Submission plugin (versions up to and including 4.5.6)
Meta Box User Profile plugin (versions up to and including 3.11.0)

Discovery Timeline

2026-09-22 - CVE-2026-13355 published to NVD
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-13355

Vulnerability Analysis

The vulnerability chains two independent flaws in Meta Box components to achieve unauthenticated privilege escalation. The mb-frontend-submission component processes form submissions through Form::process(), which lacks the user_can_edit() authorization check that is present in the corresponding render() path. Combined with unsafe handling of the target object identifier, this exposes arbitrary post modification to unauthenticated users.

Once an attacker can rewrite a page's content, the mb-user-profile component completes the chain. That component processes the [mb_user_profile_register] shortcode and trusts the role and auto_login attributes directly, without validating whether the requested role is allowed. An attacker injects a shortcode that registers a new account with the administrator role and enables automatic login.

Root Cause

The root cause is missing authorization enforcement. The populate_via_query_string() function unconditionally overrides the form's target object_id using the rwmb_frontend_field_object_id GET parameter with no capability check. Form::process() then calls wp_update_post() on the attacker-supplied post ID. Separately, the User Profile registration shortcode fails to restrict the role attribute, violating least-privilege principles.

Attack Vector

Exploitation is remote, unauthenticated, and requires no user interaction. An attacker sends a crafted request to a page that renders a Meta Box frontend submission form, supplying the rwmb_frontend_field_object_id parameter to target an arbitrary page ID. The submission overwrites post_content with an [mb_user_profile_register role="administrator" auto_login="true"] shortcode. Loading the modified page triggers the shortcode, provisioning an Administrator account for the attacker.

No verified proof-of-concept code is publicly available. See the Wordfence Vulnerability Report for additional technical detail.

Detection Methods for CVE-2026-13355

Indicators of Compromise

HTTP POST or GET requests containing the rwmb_frontend_field_object_id parameter targeting unexpected post IDs.
Modified post_content on pages containing [mb_user_profile_register] shortcodes with role="administrator" or auto_login="true" attributes.
New WordPress user accounts with the administrator role that were not created by legitimate site operators.
Unexpected revisions in the wp_posts history for pages that host Meta Box frontend forms.

Detection Strategies

Audit the wp_users and wp_usermeta tables for recently created accounts assigned the administrator role.
Scan wp_posts.post_content across all pages for occurrences of mb_user_profile_register shortcodes with elevated role values.
Review web server access logs for requests to Meta Box frontend submission endpoints that include the rwmb_frontend_field_object_id parameter.

Monitoring Recommendations

Alert on any WordPress user_register event that assigns the administrator role outside of change-approved windows.
Monitor wp_update_post activity through WordPress audit logging plugins to flag unauthenticated post modifications.
Track outbound web application firewall (WAF) blocks referencing Meta Box parameters to identify probing attempts.

How to Mitigate CVE-2026-13355

Immediate Actions Required

Update Meta Box AIO to a version above 3.11.0, Meta Box Frontend Submission above 4.5.6, and Meta Box User Profile above 3.11.0. Confirm patched releases in the Meta Box AIO Changelog and the Metabox Changelog.
Enumerate all WordPress administrator accounts and remove any that cannot be attributed to a known operator.
Review recently modified pages for injected shortcodes and restore clean content from backups where necessary.
Rotate credentials and session tokens for all remaining administrator accounts.

Patch Information

Meta Box has published fixed releases addressing the missing authorization check in Form::process() and the unsafe handling of the role and auto_login shortcode attributes. Refer to the vendor's Meta Box AIO Changelog for the exact patched version and release notes.

Workarounds

Temporarily disable the Meta Box AIO, Meta Box Frontend Submission, and Meta Box User Profile plugins until patched versions are installed.
Deploy WAF rules that block unauthenticated requests containing the rwmb_frontend_field_object_id parameter.
Restrict access to pages containing Meta Box frontend submission forms through authentication requirements at the web server layer.
Disable open user registration in WordPress settings to reduce the impact of the shortcode-based account creation path.

bash

# Configuration example: WAF rule blocking exploitation attempts (ModSecurity syntax)
SecRule ARGS:rwmb_frontend_field_object_id "@rx .*" \
    "id:1013355,phase:2,deny,status:403,log,\
    msg:'CVE-2026-13355 Meta Box privilege escalation attempt'"