~ / search / GHSA-m4q3-832v-44j6

GHSA-m4q3-832v-44j6

Meta Box Plugin for WordPress: Authenticated (Contributor+) Arbitrary File Deletion via ajax_delete_file

Source: GitHub Advisory Database (reviewed) High CVE-2025-14675

Packages

EcosystemPackageAffectedFixed in
Packagist wpmetabox/meta-box < 5.11.2 5.11.2

Details

As written in the advisory (Markdown source, shown as plain text).

The Meta Box plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'ajax_delete_file' function in all versions up to, and including, 5.11.1. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).

References

External links from the advisory. They lead to third-party sites.