CVE Database /
CVE-2025-14675
CVE · High
CVE-2025-14675 — Meta Box [meta-box] < 5.11.2
| CVE |
Vulnerability |
Type |
Severity |
Affected |
Fixed in |
Published |
Status |
|
CVE-2025-14675
|
Meta Box [meta-box] < 5.11.2 |
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') |
High
7.2
|
< 5.11.2
|
5.11.2 |
2026-03-06 |
—
|
CVE-2025-14675
Authenticated users with contributor level permissions or higher in WordPress installations using Meta Box plugin versions 5.11.1 and earlier are susceptible to deleting any file due to inadequate path validation in the 'ajax_delete_file' function, which can be exploited for malicious purposes including remote code execution by deleting specific files like wp-config.php. This vulnerability affects all versions up to and including 5.11.1 of the Meta Box plugin.
Based on public CVE data (MITRE/NVD).
Scan your WordPress site free
No signup, no credit card — enter your URL and get a security report in seconds.
See the full security page for this plugin
Browse the CVE database
Browse all security findings