The Meta Box plugin for WordPress is impacted by a flaw that permits authenticated users with Contributor or higher permissions to delete arbitrary files on the server. The vulnerability is caused by inadequate validation of file paths in the ajax_delete_file function. If an attacker can remove critical files such as wp-config.php, the deletion can facilitate remote code execution or other destructive actions.

The affected product is the Meta Box plugin (metabox:Meta Box) for WordPress. All releases up to and including version 5.11.1 are vulnerable. No other plugin versions are mentioned.

With a CVSS score of 7.2 the flaw is considered moderate to high severity, but the EPSS score is low (<1%) indicating that exploitation is unlikely at present. The flaw is not listed in the CISA KEV catalog. Exploitation requires a logged‑in user with Contributor or higher privileges who can access the plugin’s AJAX endpoint to issue a file deletion request. The attack relies on insufficient path validation, and the damage is confined to the server's file system, potentially allowing full compromise if attackers target core files.