The Meta Box – WordPress Custom Fields Framework plugin contains a missing authorization flaw that permits an attacker to access or manipulate custom fields without proper privilege checks. This broken access control is classified as CWE-862, allowing unauthorized users to read or modify data that should only be available to privileged administrators. The impact can include unauthorized data disclosure, content tampering, or escalation of privileges within the WordPress site, depending on the capabilities the attacked user gains.

The vulnerability affects the eLightUp Meta Box – WordPress Custom Fields Framework plugin for WordPress, impacting all versions from the earliest release through 5.15.2. It is relevant to any WordPress installation that has this plugin installed and enabled, regardless of the WordPress core version.

With a CVSS score of 6.5, the risk level is moderate. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalogue, suggesting no widespread exploitation is currently documented. The likely attack vector is through the plugin’s interfaces, where an attacker with limited access or an unauthenticated user may attempt to request or submit custom field data. Exploitability is constrained by the need for the plugin’s endpoints to be accessible, so sites with strict API filtering or limited user roles may reduce risk, but the absence of proper authorization makes it a significant concern for any unprotected or low‑privilege user.