The Meta Box WordPress plugin prior to version 5.13.1 lacks a permission check before deleting an attachment, allowing a user with a low‑privilege role such as Contributor to delete any arbitrary media attachment belonging to another user. This defect is an instance of unauthorized data removal and can result in loss of content and site instability for the affected site.

Any WordPress installation that uses the Meta Box plugin with a version earlier than 5.13.1 is vulnerable. The issue applies to the Meta Box plugin itself and to any sites that have not applied the 5.13.1 release or later.

The CVSS score is 5.5, indicating moderate severity, but the EPSS score of less than 1% indicates a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, which further suggests it is not currently a widely exploited target. An attacker must be authenticated and have at least Contributor privileges to trigger the deletion; thus the attack vector is authenticated and relies on IDOR. Because it only permits deletion of attachments, the damage is limited to data loss rather than full compromise.