CVE-2026-109700: Missing Authorization in eLightUp Meta Box – WordPress Custom Fields Framework

This vulnerability in the Meta Box – WordPress Custom Fields Framework arises from missing authorization checks, allowing attackers with limited privileges to access or exploit functionality that should be restricted. The affected versions include all releases prior to 5.15.3. The CVSS vector indicates the attack can be performed remotely over the network with low attack complexity and requires low privileges but no user interaction. The impact is primarily on confidentiality, with no integrity or availability impact noted.

An attacker with low privileges can exploit the missing authorization to access sensitive data, resulting in a confidentiality breach. There is no indication of impact on data integrity or availability. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, review and tighten access control configurations in the Meta Box plugin to prevent unauthorized access.