CVE-2026-8422: WordPress Meta Boxes Plugin CSRF Flaw

CVE-2026-8422 Overview

CVE-2026-8422 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the Remove Meta Boxes Per User Role plugin for WordPress. The flaw impacts all versions up to and including 1.01. The plugin fails to implement proper nonce validation on its remove-meta-boxes-per-user-role settings page. Unauthenticated attackers can modify or reset per-role meta box visibility settings by tricking a site administrator into clicking a crafted link. The weakness is classified under CWE-352.

Critical Impact

Successful exploitation allows attackers to alter the plugin's per-role meta box visibility configuration without authorization, requiring only that an administrator interact with a malicious link.

Affected Products

• WordPress Remove Meta Boxes Per User Role plugin versions 1.01 and earlier
• WordPress installations using the affected plugin in trunk and tagged release 1.01
• Sites with administrators who can be targeted through social engineering vectors

Discovery Timeline

• 2026-06-02 - CVE-2026-8422 published to NVD
• 2026-06-02 - Last updated in NVD database

Technical Details for CVE-2026-8422

Vulnerability Analysis

The vulnerability stems from missing or incorrect nonce validation on the plugin's settings page. WordPress uses nonces as anti-CSRF tokens that bind a request to a specific user session and action. Without proper validation, the plugin cannot distinguish between a legitimate administrator submission and a forged cross-origin request.

The affected code paths exist in admin_pages/settings.php at lines 23 and 26, and in remove-meta-boxes-per-role.php at line 52. These locations handle settings updates without verifying a valid nonce token. As a result, any authenticated administrator browsing an attacker-controlled page can unknowingly submit state-changing requests to their own WordPress site.

The attack requires user interaction, which limits automation but remains practical through phishing and watering-hole techniques. EPSS data indicates a low probability of active exploitation at this time.

Root Cause

The plugin author did not call wp_verify_nonce() or check_admin_referer() before processing settings updates. WordPress provides these functions specifically to defend against CSRF, but the plugin's settings handler accepts POST requests based solely on the user's authenticated session cookie.

Attack Vector

An attacker crafts a malicious web page or email containing an HTML form or image tag that submits a request to the target site's plugin settings endpoint. When a logged-in WordPress administrator visits the attacker-controlled resource, the browser automatically attaches session cookies. The plugin processes the request as legitimate and applies the attacker's chosen meta box visibility settings.

No verified proof-of-concept code is publicly available for this vulnerability. Refer to the Wordfence Vulnerability Analysis for additional technical context.

Detection Methods for CVE-2026-8422

Indicators of Compromise

• Unexpected changes to per-role meta box visibility settings in the WordPress admin dashboard
• HTTP POST requests to the remove-meta-boxes-per-user-role settings page originating from external referrers
• Administrator session activity correlated with visits to untrusted external sites or email link clicks

Detection Strategies

• Review WordPress audit logs for settings modifications to the Remove Meta Boxes Per User Role plugin that lack corresponding admin UI navigation events
• Inspect web server access logs for POST requests to /wp-admin/ plugin settings endpoints with missing or external Referer headers
• Compare current plugin configuration against a known-good baseline to identify unauthorized changes

Monitoring Recommendations

• Enable a WordPress security or audit logging plugin to capture administrator setting changes with timestamps and source IPs
• Monitor for anomalous administrator behavior such as setting changes immediately following external link interactions
• Alert on POST requests to plugin admin pages that lack valid WordPress nonce parameters

How to Mitigate CVE-2026-8422

Immediate Actions Required

• Deactivate the Remove Meta Boxes Per User Role plugin until a patched version is released and verified
• Audit current per-role meta box visibility settings and restore them to expected values if tampering is suspected
• Instruct administrators to log out of WordPress before browsing untrusted sites or clicking external links

Patch Information

At the time of publication, no fixed version has been identified in the available references. Site operators should monitor the WordPress plugin repository and the Wordfence advisory for updates and apply patches as soon as they become available.

Workarounds

• Remove or disable the plugin entirely if its functionality is not essential to site operations
• Restrict administrative access using IP allowlisting at the web server or WAF level to limit CSRF attack surface
• Deploy a WordPress security plugin or web application firewall capable of inspecting and blocking requests lacking valid nonce tokens
• Enforce browser isolation or separate accounts for administrative tasks to reduce the chance of cross-site request execution

# Example: deactivate the plugin via WP-CLI until a patch is available
wp plugin deactivate remove-meta-boxes-per-user-role

# Verify status
wp plugin status remove-meta-boxes-per-user-role