The Meta Box AIO plugin for WordPress allows an unauthenticated attacker to elevate privileges to Administrator by exploiting a chain of flaws: an unprotected GET parameter ‘rwmb_frontend_field_object_id’ can override the target post ID, and the processing routine can write to that post without checking whether the user is authorized to edit it. This flaw also enables injection of an [mb_user_profile_register] shortcode that accepts a ‘role’ attribute and is trusted without validation, giving the attacker full control over user roles. The combined effect is the ability for anyone to overwrite page content and grant themselves administrative rights, a classic example of privilege escalation (CWE‑269).

WordPress sites running the Meta Box AIO plugin up to and including version 3.11.0 are affected, as are the standalone Meta Box Frontend Submission plugin up to version 4.5.6 and the Meta Box User Profile plugin up to version 3.11.0. These components all contain the vulnerable code paths that allow the GET parameter to be processed without authentication checks.

The vulnerability carries a CVSS score of 9.8, indicating a severe risk. The EPSS score is not available, and it is not listed in CISA’s KEV catalog. Attackers can exploit the flaw remotely by sending a crafted HTTP request containing the ‘rwmb_frontend_field_object_id’ parameter to the WordPress site, without needing any prior authentication. Because the flaw bypasses normal permission checks, it allows arbitrary code execution in the form of privilege escalation and content injection. The likely attack vector is through an unauthenticated HTTP request that includes the overloaded GET parameter.