VulnSocial

CVE-2026-13355PoC

MEDIUMCVSS 9.8 · CRITICAL

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

  • Patch affected systems immediately
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

The Meta Box AIO plugin for WordPress is vulnerable to Privilege Escalation to Administrator in versions up to, and including, 3.11.0. This is due to a chained flaw: the populate_via_query_string() function in the mb-frontend-submission component unconditionally overrides the form's target object_id from the GET parameter 'rwmb_frontend_field_object_id' without any authorization check, and Form::process() lacks the user_can_edit() check present in render(), allowing unauthenticated attackers to overwrite the post_content of any page with an arbitrary shortcode via wp_update_post(); the mb-user-profile component then directly trusts the 'role' and 'auto_login' shortcode attributes in the injected [mb_user_profile_register] shortcode with no role validation. This makes it possible for unauthenticated attackers to elevate their privileges to Administrator. The standalone plugins Meta Box Frontend Submission (in versions up to 4.5.6) and Meta Box User Profile (versions up to 3.11.0) are also affected.

Back to dashboard
4.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-269

Priority

MEDIUM

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Public PoC and exploit tooling are both present
  • Patch or workaround signal is available
  • 10 mentions across 3 observed days
  • Momentum state: stable

What's happening

  • Exploit tool or code specified in 2 signals
  • PoC mentioned or linked in 4 signals
  • Patch or workaround mentioned in 3 signals
  • Technical details provided in 8 signals
  • Disclosure: 3 classified signals
  • Peaked 2d ago at 6 mentions (2026-09-22); latest day: 1
  • 10 total mentions across 3 days

Deep dive

Activity timeline10 mentions / 3d
02356Mentions · 2026-09-22: 6Mentions · 2026-09-24: 3Mentions · 2026-10-11: 1PoC Mentioned / Linked · 2026-09-22: 2PoC Mentioned / Linked · 2026-09-24: 2Exploit Tool / Code · 2026-09-22: 2Patch / Workaround · 2026-09-22: 2Patch / Workaround · 2026-10-11: 1Technical Details · 2026-09-22: 6Technical Details · 2026-09-24: 1Technical Details · 2026-10-11: 109-2209-2410-11
Signal classification4 categories
PoC
440.0%
Disclosure
330.0%
Patch
220.0%
General
110.0%
Referenced assets8 URLs
Classification over time
DateTotalLabels
2026-09-226
Disclosure3Patch1PoC2
2026-09-243
General1PoC2
2026-10-111
Patch1
Full discourse10 posts
  • Rıdvan Yağlı@ridvanyagli
    Patch

    🔴 WordPress Meta Box eklentisinde kritik yetki yükseltme açığı: CVE-2026-13355 Meta Box AIO'da bulunan ve CVSS 9.8 (Critical) olarak değerlendirilen açık, kimlik doğrulaması gerektirmeden saldırganın Administrator yetkisi elde etmesine neden olabiliyor. Açık, rwmb_frontend_field_object_id parametresi ile içerik değiştirme ve mb_user_profile_register shortcode'undaki rol doğrulama eksikliğinin zincirlenmesiyle ortaya çıkıyor. Etkilenen sürümler: • Meta Box AIO ≤ 3.11.0 • Meta Box Frontend Submission **≤ 4.5.6** • Meta Box User Profile ≤ 3.11.0 Yamalanan sürümler: • Meta Box AIO 3.12.0+ • Meta Box Frontend Submission 4.5.7+ • Meta Box User Profile 3.12.0+ 🌐 Uzaktan tetiklenebiliyor, kimlik doğrulaması ve kullanıcı etkileşimi gerektirmiyor. WordPress sitelerinde ilgili eklentilerin sürümleri kontrol edilerek güncel sürümlere yükseltilmesi gerekiyor. https://wordpress.org/plugins/meta-box/

    Post summary

    The tweet discloses CVE-2026-13355, a critical (CVSS 9.8) privilege escalation in Meta Box plugin affecting versions ≤3.11.0, requiring no authentication, and urges users to upgrade to patched versions (3.12.0+, 4.5.7+, 3.12.0+).

    00032398
    2.5K followersView on X
  • ExploitGrid@exploitgrid
    General

    🛡️ #ExploitGrid Daily #Threat Digest Critical Exploits disclosed today: CVE-2026-28576 CVE-2024-2876 CVE-2026-13355 CVE-2026-19658 CVE-2026-41089 ..🧵👇

    Post summary

    The text mentions several CVEs as critical exploits but lacks specific indicators such as PoC, exploit code, active exploitation reports, patches, or technical details, resulting in a general classification.

    2001077
    305 followersView on X
  • mürrez@murrezsec
    PoC

    CVE-2026-13355 (CVSS 9.8) — Meta Box AIO ≤3.11.0 unauth admin chain: MB Frontend Submission post_content overwrite + mb_user_profile_register role=administrator PoC: check/exploit, mass scan w/ mbfs vs mbup-only detection https://github.com/murrez/CVE-2026-13355 #CVE #WordPress #Infosec

    Post summary

    The text announces a critical unauthenticated admin chain vulnerability (CVE-2026-13355) in Meta Box AIO with a CVSS of 9.8 and shares a proof of concept (PoC) exploit script along with detection methods on GitHub.

    00020104
    636 followersView on X
  • ExploitGrid@exploitgrid
    PoC

    [EXPLOIT] CVE-2026-13355 [CRITICAL/PoC] CVE-2026-13355 🔗 https://exploitgrid.net/exploits/74777781-f1c3-44df-a54a-390f9bb1ea16

    Post summary

    The post announces CVE-2026-13355 with a [CRITICAL/PoC] label and provides a direct link to a PoC, indicating the primary focus is on sharing a proof-of-concept for the vulnerability.

    1000037
    305 followersView on X
  • ExploitGrid@exploitgrid
    PoC

    💀 CRITICAL Exploits Trending ├ CVE-2026-41089 — Netlogon RCE · PoC live ├ CVE-2026-28576 · CVE-2024-2876 · PoC live └ CVE-2026-13355 · CVE-2026-19658 · PoC live +497 more tracked today.

    Post summary

    The tweet lists several CVEs and emphasizes that proof‑of‑concept exploits are currently live and trending.

    1000070
    305 followersView on X
  • Hugo | DevOps | Cybersecurity 🇱🇻@HugoValters
    Patch

    CVE-2026-13355 Meta Box AIO for WordPress privilege escalation to admin, CVSS 9.8, unpatched. No fix available yet - restrict plugin access now. https://www.valtersit.com/cve/CVE-2026-13355 #CVE #WordPress #infosec #MetaBox #CVEALERT #CVE #infosec #Linux #XSS #valtersit #snippet #SysAdmin #cybersecurity #devsecops #devops #developer #100daysofcode #git #github #gitlab #redteam #blueteam #ethicalhacker #cybersecurityawareness #cybersecuritynews #cybersecuritytips #python #hacker #kali #ubuntu #debian #docker

    Post summary

    The post reports a critical WordPress plugin privilege-escalation vulnerability and says no fix is available yet. It recommends restricting plugin access as a workaround.

    0000050
    1.1K followersView on X
  • Upwind Security MDR@UpwindMDR
    Disclosure

    🚨Critical - Meta Box AIO Unauth Admin PrivEsc via object_id Override + Shortcode Chain (CVE-2026-13355) Meta Box AIO for WordPress lets attackers override rwmb_frontend_field_object_id to target arbitrary object_id; missing auth checks allow overwriting page content with a crafted shortcode that makes the User Profile component trust role and auto_login attributes, enabling unauthenticated admin registration/login. Sites not using Frontend Submission/User Profile shortcodes aren’t exposed. 👉Affected: Meta Box AIO <= 3.11.0; Meta Box Frontend Submission <= 4.5.6; Meta Box User Profile <= 3.11.0

    Post summary

    The text discloses CVE-2026-13355, detailing a WordPress plugin vulnerability enabling unauthenticated admin PrivEsc via object_id override and shortcode chain, affecting specific plugin versions up to 3.11.0, 4.5.6, with no evidence of active exploitation, PoC code, named exploit tools, or available patches.

    0000060
    310 followersView on X
  • ThreatAft@ThreatAft
    Disclosure

    🚨 META BOX AIO CVE-2026-13355 — CVSS 9.8 Unauthenticated → Administrator. Three flaws chained: • Unchecked object_id • Missing permission check • Unvalidated role attribute PATCH NOW. → https://threataft.com/articles/meta-box-aio-cve-2026-13355-unauthenticated-privilege-escalation #MetaBox #WordPress #PatchNow #CyberSecurity #ThreatIntel

    Post summary

    The tweet discloses a critical (CVSS 9.8) vulnerability in Meta Box AIO (CVE-2026-13355) chaining three flaws for unauthenticated admin escalation and urges immediate patching.

    0000050
    43 followersView on X
  • cybrmonk@cybr_monk
    Disclosure

    CVE-2026-13355 Lets Unauthenticated Users Grab WordPress Admin Rights in Minutes https://cybrmonk.com/blog/cve-2026-13355-lets-unauthenticated-users-grab-wordpress-admin-rights-in-minutes #cybersecurity #threatintelligence https://t.co/q7YZPg6rRh

    Post summary

    The snippet announces a newly disclosed CVE (CVE-2026-13355) that enables unauthenticated users to obtain WordPress admin rights, but it provides no further details on PoC, exploits, patches, or active exploitation.

    0000038
    45 followersView on X
  • dbugs@ptdbugs
    PoC

    A PoC/exploit has been discovered for vulnerability CVE-2026-13355 PT ID: PT-2026-96644 Vendor: WordPress / Meta Box Product: Meta Box Frontend Submission Description: The Meta Box AIO plugin for WordPress is vulnerable to Privilege Escalation to Administrator in versions up to, and including, 3.11.0. This is due to a chained flaw: the populate_via_query_string() function in the mb-frontend-submission component unconditionally overrides the form's target object_id from the GET parameter 'rwmb_frontend_field_object_id' without any authorization check, and Form::process() lacks the user_can_edit() check present in render(), allowing unauthenticated attackers to overwrite the post_content of any page with an arbitrary shortcode via wp_update_post(); the mb-user-profile component then directly trusts the 'role' and 'auto_login' shortcode attributes in the injected [mb_user_profile_register] shortcode with no role validation. This makes it possible for unauthenticated attackers to elevate their privileges to Administrator. The standalone plugins Meta Box Frontend Submission (in versions up to 4.5.6) and Meta Box User Profile (versions up to 3.11.0) are also affected. References: • https://dbu.gs/vulnerability/PT-2026-96644 • https://github.com/murrez/cve-2026-13355

    Post summary

    The text discloses a privilege escalation vulnerability (CVE-2026-13355) in the Meta Box WordPress plugin and announces the discovery of a PoC/exploit with a link to a GitHub repository.

    00000425
    3.6K followersView on X

Explore more

Back to dashboard