CVE-2026-120836: WordPress Meta Box – WordPress Custom Fields Framework plugin <= 5.15.3 - Broken Access Control vulnerability

Q: Which installations are affected?

The issue affects the eLightUp Meta Box – WordPress Custom Fields Framework plugin through version 5.15.3. The provided data does not identify a fixed version.

Q: What conditions are required for exploitation?

The vulnerability is described as missing authorization caused by incorrectly configured access-control security levels. The provided information does not specify the required attacker role, authentication status, affected endpoint, or feature configuration.

Q: Are default plugin configurations affected?

The available data does not state whether the vulnerable access-control condition is present in the default configuration.

Q: How can administrators determine whether they are affected?

Verify whether Meta Box – WordPress Custom Fields Framework is installed and whether its version is 5.15.3 or earlier. The provided data does not include indicators of compromise, logs, or request patterns that would confirm exploitation.

Published Nov 7, 2026

Updated

Missing Authorization vulnerability in eLightUp Meta Box – WordPress Custom Fields Framework meta-box allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Meta Box – WordPress Custom Fields Framework: from n/a through 5.15.3.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Meta Box – WordPress Custom Fields Framework to a version that resolves this vulnerability.
Fixed in 5.15.4

Event History

Nov 7, 2026

CVE Published

via MITRE·05:23 PM

Data Sourced

via MITRE·05:23 PM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

Which installations are affected?

The issue affects the eLightUp Meta Box – WordPress Custom Fields Framework plugin through version 5.15.3. The provided data does not identify a fixed version.

What conditions are required for exploitation?

The vulnerability is described as missing authorization caused by incorrectly configured access-control security levels. The provided information does not specify the required attacker role, authentication status, affected endpoint, or feature configuration.

Are default plugin configurations affected?

The available data does not state whether the vulnerable access-control condition is present in the default configuration.

How can administrators determine whether they are affected?

Verify whether Meta Box – WordPress Custom Fields Framework is installed and whether its version is 5.15.3 or earlier. The provided data does not include indicators of compromise, logs, or request patterns that would confirm exploitation.

CVE-2026-120836: WordPress Meta Box – WordPress Custom Fields Framework plugin <= 5.15.3 - Broken Access Control vulnerability

Remediation

Event History

Frequently Asked Questions

Which installations are affected?

What conditions are required for exploitation?

Are default plugin configurations affected?

How can administrators determine whether they are affected?

Company

Resources

Contact

Frequently Asked Questions

Which installations are affected?

What conditions are required for exploitation?

Are default plugin configurations affected?

How can administrators determine whether they are affected?