CVSS 3.0
6.5 mediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:NCVE-2019-14793
Medium (6.5) in metabox meta box. EPSS 1.7% chance of exploitation in the next 30 days.
The Meta Box plugin before 4.16.3 for WordPress allows file deletion via ajax, with the wp-admin/admin-ajax.php?action=rwmb_delete_file attachment_id parameter.
Severity
- EPSS
- 1.7% chance of exploitation in the next 30 days; higher than 77% of CVEs (scores of 2026-10-31)
- CWE
- CWE-862
- Published
- Modified
- Record from
- the NVD, synced
Affected
- metabox:meta_box
References
- https://metabox.io/changelog/
- https://www.pluginvulnerabilities.com/2019/02/01/full-disclosure-of-authenticated-arbitrary-file-deletion-vulnerability-in-wordpress-plugin-with-300000-installs/
- https://metabox.io/changelog/
- https://www.pluginvulnerabilities.com/2019/02/01/full-disclosure-of-authenticated-arbitrary-file-deletion-vulnerability-in-wordpress-plugin-with-300000-installs/