CVE-2026-39761: CWE-266 Incorrect Privilege Assignment in eLightUp Meta Box AIO

CVE-2026-39761 describes an unauthenticated privilege escalation vulnerability in Meta Box AIO plugin versions up to 3.7.1 by eLightUp. The root cause is incorrect privilege assignment (CWE-266), allowing attackers without authentication to gain elevated privileges. The CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an unauthenticated attacker to gain elevated privileges within the affected system, potentially leading to full compromise of confidentiality, integrity, and availability of the system or data managed by the Meta Box AIO plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is released, restrict access to vulnerable instances and monitor for suspicious activity related to privilege escalation attempts.