This vulnerability (CWE-862) in Meta Box – WordPress Custom Fields Framework involves missing authorization checks, which means that certain actions or data access controls are improperly enforced. This allows an attacker with low privileges to potentially access or manipulate data beyond their authorization level. The CVSS 3.1 base score is 7.1, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and high confidentiality impact with limited integrity impact. The affected product is not a cloud service, and no official fix or patch has been released as of the publication date.

An attacker with low privileges can exploit this vulnerability remotely without user interaction to gain unauthorized access to sensitive information (high confidentiality impact) and cause limited integrity issues. There is no impact on availability. This could lead to data exposure or unauthorized data manipulation within the affected WordPress framework.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is currently available, users should monitor MetaBox.io communications for updates. Until a patch is released, consider restricting access to the Meta Box plugin functionality to trusted users only and review access control configurations to minimize exposure.