The Meta Box WordPress plugin versions prior to 5.13.1 do not verify whether a user is authorized to delete a given attachment before performing the deletion. This missing authorization (CWE-862) allows users with roles that normally have limited permissions, like Contributor, to permanently delete media attachments owned by other users. The vulnerability has a CVSS 3.1 base score of 5.5, indicating a medium severity level. There is no vendor advisory or patch link provided, and no known exploits in the wild have been reported.

Unauthorized users with low-privilege roles can permanently delete media attachments that belong to other users, potentially causing data loss and disruption of content management within the affected WordPress site. There is no indication of confidentiality or availability impact beyond the deletion of media files.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles and permissions carefully to prevent low-privilege users from performing deletion actions on media attachments.