CVE-2025-14675Disclosure

LOWCVSS 7.2 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

The Meta Box plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'ajax_delete_file' function in all versions up to, and including, 5.11.1. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-22

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

4 mentions across 2 observed days
Momentum state: stable

What's happening

Technical details provided in 3 signals
Disclosure: 3 classified signals
General: 1 classified signal
Peaked 1d ago at 3 mentions (2026-03-07); latest day: 1
4 total mentions across 2 days

Deep dive

Activity timeline4 mentions / 2d

Signal classification2 categories

Disclosure

375.0%

General

125.0%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-03-07	3	Disclosure2General1
2026-03-12	1	Disclosure1

Full discourse4 posts

CRAC Learning - Tech@cracbot211d
Disclosure
CVE-2025-14675 (CVSS:7.2, HIGH) is Awaiting Analysis. The Meta Box plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in t..https://nvd.nist.gov/vuln/detail/CVE-2025-14675 #cybersecurityawareness #cybersecurity #CVE #infosec #hacker #nvd #mitre
Post summary
The post announces CVE-2025-14675, details it as a high-severity arbitrary file deletion flaw in the Meta Box WordPress plugin, but does not provide a PoC, exploit code, active exploitation evidence, or patch information.
0000046
172 followersView on X
CVE@CVEnew215d
Disclosure
CVE-2025-14675 The Meta Box plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'ajax_delete_file' function in all versions… https://www.cve.org/CVERecord?id=CVE-2025-14675
Post summary
The Meta Box WordPress plugin has an all‑versions flaw that permits arbitrary file deletion via the 'ajax_delete_file' function due to inadequate file path validation.
00000204
56.6K followersView on X
RedPacket Security@RedPacketSec216d
General
CVE Alert: CVE-2025-14675 - metabox - Meta Box - https://www.redpacketsecurity.com/cve-alert-cve-2025-14675-metabox-meta-box/ #OSINT #ThreatIntel #CyberSecurity #cve-2025-14675 #metabox #meta-box
Post summary
A concise CVE alert linking to an external site, but without technical, exploit, or mitigation details.
00000248
3.5K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds216d
Disclosure
CVE-2025-14675 Authenticated Arbitrary File Deletion Vulnerability in Meta Box WordPress Plugin https://vulmon.com/vulnerabilitydetails?qid=CVE-2025-14675
Post summary
This entry discloses CVE‑2025‑14675, an authenticated arbitrary file deletion flaw in the Meta Box WordPress plugin, providing only a brief vulnerability description and no PoC, exploit, or patch details.
00000106
4.0K followersView on X

Explore more

Back to dashboard

What researchers are saying

CVE-2025-14675

CRAC Learning - Tech@cracbotDisclosure

The post announces CVE-2025-14675, details it as a high-severity arbitrary file deletion flaw in the Meta Box WordPress plugin, but does not provide a PoC, exploit code, active exploitation evidence, or patch information.

CVE@CVEnewDisclosure

The Meta Box WordPress plugin has an all‑versions flaw that permits arbitrary file deletion via the 'ajax_delete_file' function due to inadequate file path validation.

RedPacket Security@RedPacketSecGeneral

A concise CVE alert linking to an external site, but without technical, exploit, or mitigation details.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

This entry discloses CVE‑2025‑14675, an authenticated arbitrary file deletion flaw in the Meta Box WordPress plugin, providing only a brief vulnerability description and no PoC, exploit, or patch details.