CVE-2026-8422 is a Cross-Site Request Forgery vulnerability in the Remove meta boxes per user role WordPress plugin affecting all versions up to and including 1.01. The issue arises from missing or incorrect nonce validation on the 'remove-meta-boxes-per-user-role' page, enabling attackers to perform unauthorized changes to per-role meta box visibility settings by tricking an administrator into submitting a crafted request. The vulnerability does not require privileges or authentication but does require user interaction (UI:R).

An attacker can cause an administrator to unknowingly modify or reset the plugin's meta box visibility settings for different user roles. This can lead to unauthorized changes in the WordPress admin interface layout per user role, potentially disrupting administrative workflows or exposing unintended UI elements. There is no direct confidentiality or availability impact reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should be cautious about clicking on untrusted links or performing actions from untrusted sources while logged into WordPress with administrative privileges. Monitoring for updates from the plugin vendor or WordPress security advisories is recommended.