CVE-2026-13355 is a critical privilege escalation vulnerability affecting the Meta Box AIO plugin and its standalone components Meta Box Frontend Submission (<=4.5.6) and Meta Box User Profile (<=3.11.0). The vulnerability arises from a chained flaw: the populate_via_query_string() function in the mb-frontend-submission component overrides the form's target object_id from an unauthenticated GET parameter without authorization checks. Additionally, Form::process() lacks the user_can_edit() check found in render(), enabling attackers to overwrite post_content of any page with arbitrary shortcodes via wp_update_post(). The mb-user-profile component then trusts the 'role' and 'auto_login' attributes in the injected [mb_user_profile_register] shortcode without validating roles, allowing privilege escalation to Administrator.

An unauthenticated attacker can exploit this vulnerability to overwrite content on any page with arbitrary shortcodes and escalate their privileges to Administrator on the affected WordPress site. This results in full control over the site, including the ability to modify content, install plugins, and manage users, posing a critical security risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to vulnerable plugin components and monitor for suspicious activity. Do not rely on the affected versions as safe. Follow vendor updates closely for patches addressing this vulnerability.