Security Alert Summary
The eLightUp Meta Box – WordPress Custom Fields Framework contains a missing authorization (broken access control) vulnerability that can allow actions or data exposure when access control is incorrectly configured. Sites running affected versions may be able to be accessed by low-privileged accounts in ways the plugin intended to restrict.
CVE Details
- CVE ID: CVE-2026-109700
- Affected component: eLightUp Meta Box – WordPress Custom Fields Framework (package: meta-box)
- Affected versions: from n/a through 5.15.2 (<= 5.15.2)
- Published: October 20, 2026 at 4:17 PM UTC
- Last modified: October 20, 2026 at 4:17 PM UTC
- CVSS v3.1: Base Score 6.5, MEDIUM. Vector:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Authentication / Privileges / User Interaction: Privileges Required: LOW (requires an account with low privileges). User Interaction: NONE. Attack Vector: NETWORK.
- Primary impact: Confidentiality: HIGH; Integrity: NONE; Availability: NONE
- Weakness (CWE): CWE-862 (Missing Authorization)
Technical Details
The vulnerability is described as a missing authorization issue that results from incorrectly configured access control within the Meta Box plugin. Because access checks are absent or insufficient in affected code paths, authenticated users with low privileges may be able to perform operations or retrieve data that should be restricted. The CVE description and CVSS metrics indicate broken access control leading to a high impact on confidentiality. No specific functions, REST endpoints, or code paths are named in the provided data.
How This Could Impact Your Website
On a multi-user WordPress site, a low-privileged account such as a contributor or a contractor could exploit missing authorization to access confidential information that the plugin protects. In a typical scenario, a site owner and editors expect certain custom field data to be restricted to administrators, but a low-privileged external contributor might be able to view or enumerate sensitive metadata. Practical consequences include exposure of internal user email addresses or other protected fields, and an increased risk of targeted phishing or social engineering against staff whose information is exposed. If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin to a non-affected version when available. The affected data indicates changes at 5.15.3 showing an unaffected status; update to 5.15.3 or later if that version is available for your install.
- Review and reduce unnecessary user roles and privileges, especially for contributors and other low-privilege accounts.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins and keep all plugins and themes up to date.
- Monitor site activity and logs for unusual behavior, such as unexpected access to custom field data or bulk enumeration of user information.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
