CVE-2026-13355 — Meta Box AIO ≤ 3.11.0 Unauthenticated Admin Privilege Escalation
September 25, 2026 · 383 views
Chained unauthenticated privilege escalation to **administrator** in Meta Box AIO (≤ 3.11.0) involving **MB Frontend Submission** (≤ 4.5.6) frontend submission logic.
Description
Overview
CVE-2026-13355 is a chained issue in the Meta Box All-in-One bundle (≤ 3.11.0), including MB Frontend Submission ≤ 4.5.6. Attackers without accounts may abuse frontend submission flows to escalate to WordPress administrator.
Impact
Full site takeover: plugin installation, user management, backdoors, and data theft.
Affected software
- Meta Box AIO ≤ 3.11.0
- MB Frontend Submission ≤ 4.5.6 (component called out in research)
Remediation
Update Meta Box packages through official channels immediately on any site using frontend submission features.
Legal and ethical use
Use bundled tools only on WordPress sites you own or have written authorization to test. Unauthorized scanning or exploitation is illegal in most jurisdictions.
References
- Look up the CVE ID on NVD and the CVE Program for official records.
- Apply vendor/plugin updates from the official repository or vendor advisory before relying on any PoC.
Related PoCs
Same platform, vendor, or tags — explore more write-ups on Pocbit.
- WordPressCVE-2026-14281critical
CVE-2026-14281 — WAWP WordPress Unauthenticated Privilege Escalation (≤ 4.8.6)
Unauthenticated administrator via public WAWP REST signup: unsanitized wawp_custom_fields writes wp_capabilities through update_user_meta. Automation Web Platform plugin ≤ 4.8.6 (CVSS 3.1 9.8 Critical).
- WordPressCVE-2026-12793critical
CVE-2026-12793 — JetFormBuilder ≤ 3.6.2 Unauthenticated Privilege Escalation
Unauthenticated privilege escalation in the WordPress JetFormBuilder plugin (≤ 3.6.2) via the `_jet_engine_booking_form_id` handling path. Attackers may gain elevated capabilities without valid credentials.
- WordPressCVE-2026-18143critical
CVE-2026-18143 — Addify Request a Quote for WooCommerce Unauthenticated File Upload
Unauthenticated arbitrary file upload (CWE-434, CVSS 9.8 Critical) in Request a Quote for WooCommerce ≤ 2.9.2 via public AJAX afrfq_submit_quote_via_popup — unsafe move_uploaded_file() with attacker-controlled .php names into web-accessible RFQ temp storage. Requires popup quote rule on the storefront.
- WordPressCVE-2026-19660critical
CVE-2026-19660 — Divi Membership (DiviEngine) ≤2.3.0 paypal_param Authentication Bypass
DiviEngine Divi Membership ≤2.3.0: process_paypal_callback on init trusts base64 paypal_param GET without PayPal/IPN validation → wp_set_current_user + wp_set_auth_cookie as arbitrary user ID (incl. admin). PayPal gateway class loads even when disabled. CVSS 9.8 Critical (CWE-287). Python PoC: check/exploit, cookie export, mass scan.