Is CVE-2026-109700 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-109700 being exploited in the wild.

How severe is CVE-2026-109700?

Medium severity, with a CVSS score of 6.5, published 20 October 2026.

Which products and versions are affected?

eLightUp Meta Box – WordPress Custom Fields Framework through 5.15.2.

Is there a fix for CVE-2026-109700?

Yes: fixed in 5.15.3. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-109700 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-109700?

Check whether you run eLightUp Meta Box – WordPress Custom Fields Framework at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-109700: Meta Box missing authorization in custom fields access control

CVE-2026-109700 · Severity: medium · CVSS 6.5 · Published 2026-10-20

Meta Box is a WordPress plugin that helps site administrators create and manage custom content fields. A broken access control vulnerability allows contributors and lower-privilege users to access or modify custom fields and pages they should not be permitted to view or edit, potentially exposing sensitive data or enabling unauthorized modifications.

Technologies: eLightUp Meta Box – WordPress Custom Fields Framework. Vendors: eLightUp.

Quick answers

Is CVE-2026-109700 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-109700 being exploited in the wild.
How severe is CVE-2026-109700?: Medium severity, with a CVSS score of 6.5, published 20 October 2026.
Which products and versions are affected?: eLightUp Meta Box – WordPress Custom Fields Framework through 5.15.2.
Is there a fix for CVE-2026-109700?: Yes: fixed in 5.15.3. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-109700 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-109700?: Check whether you run eLightUp Meta Box – WordPress Custom Fields Framework at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 5.15.3

Technical details

A missing authorization check in Meta Box – WordPress Custom Fields Framework versions up to 5.15.2 allows users with the Contributor role (or similar lower privileges) to bypass access control restrictions on custom fields. The vulnerability stems from incorrectly configured security levels in the meta-box component. An authenticated attacker with contributor-level access can view or manipulate fields restricted to higher privilege levels without requiring elevated permissions.

Affected products

eLightUp Meta Box – WordPress Custom Fields Framework through 5.15.2

Timeline

2026-10-20: disclosed: Published on Patchstack
2026-10-20: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.