CVE-2026-13355 — Meta Box AIO Unauthenticated Privilege Escalation to Administrator

Executive Summary

CVSS Score: 9.8 (Critical)

Meta Box AIO, the bundled distribution of the popular Meta Box custom-fields framework for WordPress (which packages the Frontend Submission and User Profile add-ons), is affected by an unauthenticated privilege-escalation vulnerability tracked as CVE-2026-13355. The flaw is a chain of two separate authorization gaps: the Frontend Submission component fails to validate which post a form is allowed to target, and the User Profile component fails to validate the role a submitted shortcode is allowed to assign. Combined, they let an attacker with no account and no prior access rewrite the content of any page on the site and use that rewritten content to self-register as a WordPress Administrator.

The issue was discovered by researcher h0xilo and assigned by Wordfence. It was publicly disclosed on 2026-09-22 with a maximum-practical CVSS v3.1 score of 9.8. As of publication, CVE-2026-13355 is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, but a proof-of-concept scanner/exploit tool referencing this CVE has already surfaced publicly, so the window between disclosure and mass scanning should be treated as very short.

Vulnerability Overview

Affected Versions

Sites running the all-in-one Meta Box AIO bundle are exposed through the same code paths as sites running the standalone Frontend Submission and User Profile add-ons together, since Meta Box AIO packages both.

Attack Vector

The chain runs entirely through unauthenticated HTTP requests to a site's existing Meta Box Frontend Submission form, with no login and no prior access required:

1. The site has a page/post that embeds a Meta Box Frontend
   Submission form (a common pattern for guest posting, contact
   forms, or user-generated content).

2. populate_via_query_string() in the mb-frontend-submission
   component reads the GET parameter `rwmb_frontend_field_object_id`
   and unconditionally uses it to override which post/page object
   the form will write to — with no authorization check that the
   requester is allowed to edit that object.

3. Form::process() (the code path that actually saves submitted
   data) omits the `user_can_edit()` check that the form's own
   render() method uses when just displaying the form. Because
   process() is looser than render(), an attacker can submit to
   a form even though they could never have legitimately seen an
   editable version of it for the target object.

4. The attacker crafts a POST to the Frontend Submission form URL
   with `rwmb_frontend_field_object_id` pointing at an arbitrary
   page ID, and a submitted field value containing the shortcode
   `[mb_user_profile_register]` with attacker-chosen `role` and
   `auto_login` attributes. This gets written into that page's
   `post_content` via `wp_update_post()`.

5. When the now-poisoned page is rendered, WordPress executes the
   injected `[mb_user_profile_register]` shortcode. The
   mb-user-profile component trusts the shortcode's `role` and
   `auto_login` attributes directly, with no validation that the
   requester is entitled to register as that role.

6. The attacker requests the poisoned page, the shortcode fires,
   and a new user account is created with the attacker-chosen
   role — set to Administrator — and (via `auto_login`) the
   attacker is logged in as that account immediately.

No credentials, cookies, or prior interaction with the target WordPress installation are required at any step. A public proof-of-concept tool (a Python scanner/exploit distributed under the CVE-2026-13355 name) implements this flow as a "check" mode to detect vulnerable installs and an "exploit" mode that takes a form URL and target object/post ID. Reported real-world caveats include that some forms (e.g. contact or newsletter forms) lack a genuine post_content field to overwrite, which can cause the exploit to fail even against an unpatched site, and that an HTTP 403 response to the crafted POST usually indicates a WAF or hosting-provider block rather than a patched plugin.

Impact of Successful Exploitation

Immediate Remediation

1. Update immediately to Meta Box AIO 3.12.0 or later (and the corresponding patched releases of the standalone Frontend Submission and User Profile plugins if run separately). Given the 9.8 CVSS score, unauthenticated attack path, and public PoC, treat this as an emergency out-of-band patch, not a scheduled one.
2. If you cannot patch immediately:
   • Disable or remove any Meta Box Frontend Submission forms that are publicly accessible to anonymous visitors until patched.
   • Audit recent post_content changes on pages that expose Frontend Submission forms, looking specifically for an injected [mb_user_profile_register] shortcode.
   • Consider a WAF rule that blocks requests carrying the rwmb_frontend_field_object_id GET parameter from unauthenticated sessions as a stopgap.
3. Review all WordPress Administrator accounts for any created after 2026-06-25 (the CVE's reservation date) that you cannot account for, and disable/remove any that are unrecognized.
4. Rotate credentials and API keys reachable from the WordPress admin area if an unrecognized Administrator account is found, since Administrator access allows arbitrary PHP execution via the plugin/theme editor.

Detection Indicators

Post-Remediation Steps

1. Confirm the installed Meta Box AIO (or standalone Frontend Submission / User Profile) version reports the patched release after upgrading.
2. Review the full list of Administrator accounts and confirm every one is recognized and legitimate; remove any that are not.
3. Diff post_content on all pages that expose a Frontend Submission form against known-good backups to confirm no injected shortcode remains.
4. Rotate WordPress admin credentials, application passwords, and any API keys/secrets that were reachable from the admin dashboard.
5. Review server and WAF logs for the indicators above going back to at least 2026-06-25 to determine whether exploitation occurred before the public disclosure.
6. Re-audit any other Meta Box add-ons in use for similar "trust a shortcode/query-string attribute without an authorization check" patterns, since this CVE is itself a chain across two components from the same vendor.

References

• NVD — CVE-2026-13355
• Meta Box — Changelog
• Meta Box AIO — Changelog
• Wordfence Threat Intelligence