The Meta Box AIO plugin in WordPress has a missing authorization flaw that allows an attacker to delete any post or page without credentials. The weakness is located in the MB Frontend Submission extension, where the delete action is routed through handle_request() without a capability or ownership check, and the nonce verification is bypassed during template_redirect requests. An attacker can trigger the deletion by including the mbfs_delete action and an attacker‑controlled rwmb_frontend_field_object_id in a URL, causing arbitrary content removal.

All installations of this plugin up to and including version 3.8.0 are affected. The vulnerability applies to any site where the frontend submission feature is enabled, regardless of the allow_delete setting. The attack surface is present whenever the MB Frontend Submission extension is loaded on a page.

The CVSS score of 9.1 indicates high severity, yet the EPSS score of less than 1% reflects a currently low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires only web access to the site and does not need authentication; by crafting a request to a page with a frontend form, an attacker can delete arbitrary content and disrupt site availability.