CVE-2025-14675: Meta Box Plugin for WordPress: Authenticated (Contributor+) Arbitrary File Deletion via ajax_delete_file
(updated )
The Meta Box plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the ‘ajax_delete_file’ function in all versions up to, and including, 5.11.1. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
References
- github.com/advisories/GHSA-m4q3-832v-44j6
- github.com/wpmetabox/meta-box
- github.com/wpmetabox/meta-box/commit/08c6511607b9cc9fe8d0de7a7e91c9d5d415f831
- github.com/wpmetabox/meta-box/pull/1654
- nvd.nist.gov/vuln/detail/CVE-2025-14675
- plugins.trac.wordpress.org/browser/meta-box/tags/5.11.0/inc/fields/file.php
- plugins.trac.wordpress.org/browser/meta-box/tags/5.11.0/inc/fields/file.php
- plugins.trac.wordpress.org/changeset/3475210/meta-box
- www.wordfence.com/threat-intel/vulnerabilities/id/036467de-95bb-4bfd-9522-df8dc17f3102?source=cve
Code Behaviors & Features
Detect and mitigate CVE-2025-14675 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →