Description
The Meta Box WordPress plugin before 5.13.1 does not verify that a user is authorized to delete the supplied attachment before deleting it, allowing users with a low-privilege role such as Contributor to permanently delete arbitrary media attachments belonging to other users.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Meta Box | < 5.13.1 | 5.13.1 |
References
- https://wpscan.com/vulnerability/a101136d-606f-4529-ae78-a4fff7724e2c/ exploit vdb-entry technical-description