Threat database

Missing Authorization vulnerability in eLightUp Meta Box – WordPress Custom Fields Framework meta-box allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Meta Box – WordPress Custom Fields Framework: from n/a through 5.15.2.

Unauthenticated Privilege Escalation in Meta Box AIO <= 3.7.1 versions.

Contributor Broken Access Control in Slim SEO <= 4.6.2 versions.

CVE-2026-39468 is a path traversal vulnerability in the Meta Box – WordPress Custom Fields Framework by eLightUp, affecting versions up to and including 5.11.1. This flaw allows an attacker with contributor-level privileges to delete arbitrary files. The vulnerability has a CVSS score of 6.8, indicating a medium severity level. No official patch or remediation guidance is currently provided by the vendor. There are no known exploits in the wild at this time.