Meta Box <= 4.16.2 - Arbitrary File Deletion

highseverity

8.1CVSS score

1.7%likelihood of exploitation, next 30 days

78%of all CVEs are less likely

Readycheck to confirm it

The Meta Box plugin for WordPress is vulnerable to arbitrary file deletion in the ajax_delete_file function. The function accepts any attachment_id from the POST request and directly calls wp_delete_attachment() or unlink() without validating that the attachment belongs to the specified Meta Box field, without path traversal protection on the unlink path, and without any ownership or authorization checks. This makes it possible for authenticated attackers to delete arbitrary files on the server including wp-config.php.

Impact

Authenticated attackers can delete arbitrary files on the server. Deleting wp-config.php triggers the WordPress installation wizard, allowing the attacker to reconfigure the database connection and achieve remote code execution.

Fix

Update Meta Box to version 4.16.3 or later, which adds in_array validation to verify the attachment is stored in the field value and upload_dir path normalization to ensure deletion stays within ABSPATH.

How to confirm it

Send: GET {{BaseURL}}/wp-content/plugins/meta-box/readme.txt
Positive when: contains(body, "Meta Box") and compare_versions(version, "<= 4.16.2")

Run it with nuclei: nuclei -id CVE-2019-14793 -u <target>

The full check

id: CVE-2019-14793

info:
  name: Meta Box <= 4.16.2 - Arbitrary File Deletion
  author: ritikchaddha
  severity: high
  description: |
    The Meta Box plugin for WordPress is vulnerable to arbitrary file deletion in the ajax_delete_file function. The function accepts any attachment_id from the POST request and directly calls wp_delete_attachment() or unlink() without validating that the attachment belongs to the specified Meta Box field, without path traversal protection on the unlink path, and without any ownership or authorization checks. This makes it possible for authenticated attackers to delete arbitrary files on the server including wp-config.php.
  impact: |
    Authenticated attackers can delete arbitrary files on the server. Deleting wp-config.php triggers the WordPress installation wizard, allowing the attacker to reconfigure the database connection and achieve remote code execution.
  remediation: |
    Update Meta Box to version 4.16.3 or later, which adds in_array validation to verify the attachment is stored in the field value and upload_dir path normalization to ensure deletion stays within ABSPATH.
  reference:
    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/meta-box/meta-box-4162-arbitrary-file-deletion
    - https://nvd.nist.gov/vuln/detail/CVE-2019-14793
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
    cvss-score: 8.1
    cve-id: CVE-2019-14793
    epss-score: 0.0172
    epss-percentile: 0.77667
    cwe-id: CWE-862
  metadata:
    verified: true
    max-request: 1
    vendor: metabox
    product: meta-box
    framework: wordpress
    publicwww-query: "/wp-content/plugins/meta-box/"
  tags: cve,cve2019,wordpress,wp,wp-plugin,meta-box,file-deletion,passive

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/plugins/meta-box/readme.txt"

    matchers:
      - type: dsl
        dsl:
          - contains(body, "Meta Box")
          - compare_versions(version, "<= 4.16.2")
        condition: and

    extractors:
      - type: regex
        name: version
        part: body
        group: 1
        regex:
          - '(?i)Stable tag:\s*([0-9.]+)'
        internal: true

References

Use this check only on systems you are authorised to test. Where the data comes from