CVE-2026-39761

eLightUp Meta Box AIO

Published 6 Oct 2026 · updated 6 Oct 2026 · Deferred

9.8 Critical · CVSS 3.1, patchstack.com

Description

Unauthenticated Privilege Escalation in Meta Box AIO <= 3.7.1 versions.

References

patchstack.com/database/wordpress/plugin/meta-box-aio/vulnerability/wordpress-meta-box-aio-plugin-3-7-1-privilege-escalation-vulnerability?_s_id=cve