The Meta Box plugin for WordPress is vulnerable to arbitrary file deletion in the ajax_delete_file function. The function accepts any attachment_id from the POST request and directly calls wp_delete_attachment() or unlink() without validating that the attachment belongs to the specified Meta Box field, without path traversal protection on the unlink path, and without any ownership or authorization checks. This makes it possible for authenticated attackers to delete arbitrary files on the server including wp-config.php.
PoC
id: CVE-2019-14793
info:
name: Meta Box <= 4.16.2 - Arbitrary File Deletion
author: ritikchaddha
severity: high
description: |
The Meta Box plugin for WordPress is vulnerable to arbitrary file deletion in the ajax_delete_file function. The function accepts any attachment_id from the POST request and directly calls wp_delete_attachment() or unlink() without validating that the attachment belongs to the specified Meta Box field, without path traversal protection on the unlink path, and without any ownership or authorization checks. This makes it possible for authenticated attackers to delete arbitrary files on the server including wp-config.php.
impact: |
Authenticated attackers can delete arbitrary files on the server. Deleting wp-config.php triggers the WordPress installation wizard, allowing the attacker to reconfigure the database connection and achieve remote code execution.
remediation: |
Update Meta Box to version 4.16.3 or later, which adds in_array validation to verify the attachment is stored in the field value and upload_dir path normalization to ensure deletion stays within ABSPATH.
reference:
- https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/meta-box/meta-box-4162-arbitrary-file-deletion
- https://nvd.nist.gov/vuln/detail/CVE-2019-14793
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
cvss-score: 8.1
cve-id: CVE-2019-14793
epss-score: 0.01706
epss-percentile: 0.76128
cwe-id: CWE-862
metadata:
verified: true
max-request: 1
vendor: metabox
product: meta-box
framework: wordpress
publicwww-query: "/wp-content/plugins/meta-box/"
tags: cve,cve2019,wordpress,wp,wp-plugin,meta-box,file-deletion,passive
http:
- method: GET
path:
- "{{BaseURL}}/wp-content/plugins/meta-box/readme.txt"
matchers:
- type: dsl
dsl:
- contains(body, "Meta Box")
- compare_versions(version, "<= 4.16.2")
condition: and
extractors:
- type: regex
name: version
part: body
group: 1
regex:
- '(?i)Stable tag:\s*([0-9.]+)'
internal: true
# digest: 4b0a004830460221009284a55cea93cd4cd309004642600920f13947b97f19fa86e29a2e3701a517ee022100ec0a5c1c13c61d06b552fd0e88fb717a532a72093c1ead00666fbdec36e91586:922c64590222798bb761d5b6d8e72950
# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.