The vulnerability identified as CVE-2026-39468 involves improper limitation of a pathname to a restricted directory (CWE-22) in the Meta Box – WordPress Custom Fields Framework plugin for WordPress. Specifically, contributor-level users can exploit this flaw to delete arbitrary files on the affected system. The affected versions are all versions up to and including 5.11.1. The CVSS 3.1 base score is 6.8, reflecting network attack vector, high attack complexity, no privileges required, no user interaction, and a scope change with impact limited to availability (denial of service through file deletion). No official fix or patch has been documented, and no known exploits have been reported in the wild.

An attacker with contributor privileges can delete arbitrary files on the server running the vulnerable plugin. This can lead to denial of service or disruption of the website or application functionality. The confidentiality and integrity of data are not impacted according to the CVSS vector, but availability is severely affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access and monitor for suspicious activity related to file deletions. Avoid granting contributor privileges to untrusted users. Follow updates from the vendor eLightUp for any forthcoming patches or official mitigations.