The Meta Box plugin for WordPress contains an arbitrary file deletion vulnerability that enables authenticated attackers to compromise server integrity and potentially achieve remote code execution.

This vulnerability is a path traversal flaw (CWE-22) located in the ajax_delete_file function. It allows authenticated attackers with Contributor-level access or higher to delete arbitrary files on the host server, which can be leveraged to delete critical files like wp-config.php and facilitate remote code execution.

The potential for arbitrary file deletion presents a high risk to business operations, as an attacker could disrupt service availability by deleting configuration files or gain unauthorized control over the WordPress environment. With a CVSS score of 7.2, this vulnerability is classified as High, reflecting the significant impact on data integrity and system availability.

Immediate Action: Update the Meta Box plugin to version 5.11.2 or later to resolve the path validation flaw.

Proactive Monitoring: Monitor server logs for unusual file deletion activity or unauthorized access attempts targeting the wp-config.php file or other sensitive directory paths.

Compensating Controls: Implement a Web Application Firewall (WAF) to block requests containing directory traversal sequences, such as dot-dot-slash patterns, directed at plugin-specific AJAX endpoints.

Public Exploit Available: No — there is no confirmed public exploit available.

Given the severity of the potential impact, including the possibility of remote code execution, organizations should prioritize updating the Meta Box plugin immediately. Ensure that user roles are strictly managed, as this vulnerability requires at least Contributor-level access to exploit. Regular updates and adherence to the principle of least privilege remain the most effective defenses against such plugin-based threats.