Meta Box <= 4.16.2 - Arbitrary File Deletion

id: CVE-2019-14793

info:
  name: Meta Box <= 4.16.2 - Arbitrary File Deletion
  author: ritikchaddha
  severity: high
  description: |
    The Meta Box plugin for WordPress is vulnerable to arbitrary file deletion in the ajax_delete_file function. The function accepts any attachment_id from the POST request and directly calls wp_delete_attachment() or unlink() without validating that the attachment belongs to the specified Meta Box field, without path traversal protection on the unlink path, and without any ownership or authorization checks. This makes it possible for authenticated attackers to delete arbitrary files on the server including wp-config.php.
  impact: |
    Authenticated attackers can delete arbitrary files on the server. Deleting wp-config.php triggers the WordPress installation wizard, allowing the attacker to reconfigure the database connection and achieve remote code execution.
  remediation: |
    Update Meta Box to version 4.16.3 or later, which adds in_array validation to verify the attachment is stored in the field value and upload_dir path normalization to ensure deletion stays within ABSPATH.
  reference:
    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/meta-box/meta-box-4162-arbitrary-file-deletion
    - https://nvd.nist.gov/vuln/detail/CVE-2019-14793
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
    cvss-score: 8.1
    cve-id: CVE-2019-14793
    epss-score: 0.01005
    epss-percentile: 0.5957
    cwe-id: CWE-862
  metadata:
    verified: true
    max-request: 1
    vendor: metabox
    product: meta-box
    framework: wordpress
    publicwww-query: "/wp-content/plugins/meta-box/"
  tags: cve,cve2019,wordpress,wp,wp-plugin,meta-box,file-deletion,passive

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/plugins/meta-box/readme.txt"

    matchers:
      - type: dsl
        dsl:
          - contains(body, "Meta Box")
          - compare_versions(version, "<= 4.16.2")
        condition: and

    extractors:
      - type: regex
        name: version
        part: body
        group: 1
        regex:
          - '(?i)Stable tag:\s*([0-9.]+)'
        internal: true
# digest: 4a0a00473045022100e1e34ed5f619a784cb7002573929d1f7ecd755a942bd1d5fc9550441f9339a360220257349e0cc13c6ae121e2925d9175b8848a695172a0c9e45d3d39852d5e8aa45:922c64590222798bb761d5b6d8e72950