Act nowDisclosed

Advisory · CVE-2026-13355

Meta Box AIO lets unauthenticated attackers create administrator accounts

A chained authorization flaw in Meta Box AIO (and the standalone Meta Box Frontend Submission and Meta Box User Profile plugins) lets unauthenticated attackers overwrite any page with a crafted shortcode and register an Administrator account. Fixed in Meta Box AIO 3.12.0.

Advisory published September 22, 2026Independent summary
Vendor
Meta Box
Product
Meta Box AIO
Identifier / CWE
CVE-2026-13355
CWE-269
Action timing
Immediate
ELI5

Explain it like I’m five

Meta Box lets site visitors fill out forms on the page. The form had two missing bouncers: one let a stranger point the form at any page on the site, and another let a stranger write a note saying 'make me the boss.' The site read the note and obeyed.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Target hijack

    An unauthenticated attacker calls the frontend submission endpoint with the GET parameter rwmb_frontend_field_object_id set to the ID of any page; populate_via_query_string() overrides the form's target object without an authorization check.

  2. 02Shortcode injection

    Form::process() lacks the user_can_edit() check that render() performs, so the attacker overwrites the page's post_content with an arbitrary shortcode via wp_update_post().

  3. 03Register shortcode

    The attacker injects the [mb_user_profile_register] shortcode with role and auto_login attributes.

  4. 04Admin account

    The mb-user-profile component trusts those shortcode attributes with no role validation, creating a new user with the Administrator role and logging the attacker in automatically.

What happened

Wordfence disclosed a privilege-escalation chain in the Meta Box AIO plugin for WordPress rated critical at CVSS 9.8. Meta Box AIO versions up to and including 3.11.0 are affected, along with the standalone Meta Box Frontend Submission plugin (versions up to 4.5.6) and Meta Box User Profile plugin (versions up to 3.11.0).

The flaw has two halves. First, the frontend submission component’s populate_via_query_string() function copies the target object ID from a GET parameter with no authorization check, and Form::process() never performs the user_can_edit() check that render() does, so an unauthenticated attacker can rewrite the post_content of any page. Second, the user profile component passes the role and auto_login shortcode attributes of [mb_user_profile_register] straight through without validation. Together, they let a stranger turn a public page into an admin-registration form and use it.

The vendor’s Meta Box AIO 3.12.0 release, dated September 17, 2026, adds the missing authorization check in the frontend’s Form::process() to block the unauthorized edits.

What to do

  1. Update Meta Box AIO to 3.12.0 or later through the WordPress updater, and bring the standalone Meta Box Frontend Submission and Meta Box User Profile plugins to their latest releases.
  2. Audit user accounts for newly created administrators, especially any created since the site became exposed.
  3. Review access logs for requests carrying the rwmb_frontend_field_object_id parameter or unexpected calls to frontend submission endpoints.
  4. Check page content for injected [mb_user_profile_register] shortcodes or other unexpected shortcode blocks.
  5. Remove any rogue administrator accounts and rotate credentials for the remaining administrators.
  6. If patching is delayed, disable frontend submission forms until the update is applied.

Management note

This is the worst kind of WordPress plugin flaw: unauthenticated, rated 9.8, and it ends with a full site takeover in one chain. Meta Box is a widely deployed toolkit, so treat every site running its frontend submission or user profile components as a candidate for compromise review, not just an update.