/Vulnerability Library

Meta Box <= 4.16.2 - Arbitrary File Deletion

CVE-2019-14793
Verified

Description

The Meta Box plugin for WordPress is vulnerable to arbitrary file deletion in the ajax_delete_file function. The function accepts any attachment_id from the POST request and directly calls wp_delete_attachment() or unlink() without validating that the attachment belongs to the specified Meta Box field, without path traversal protection on the unlink path, and without any ownership or authorization checks. This makes it possible for authenticated attackers to delete arbitrary files on the server including wp-config.php.

Severity

High

CVSS Score

8.1

Exploit Probability

2%

Affected Product

meta-box

Published Date

August 1, 2026

Template Author

ritikchaddha

CVE-2019-14793.yaml
8.1Score

CVSS Metrics

CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
CVE ID:
cve-2019-14793
CWE ID:
cwe-862

References

https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/meta-box/meta-box-4162-arbitrary-file-deletionhttps://nvd.nist.gov/vuln/detail/CVE-2019-14793

Remediation Steps

Update Meta Box to version 4.16.3 or later, which adds in_array validation to verify the attachment is stored in the field value and upload_dir path normalization to ensure deletion stays within ABSPATH.