# CVE-2026-109700: Meta Box missing authorization in custom fields access control

Source: https://junglewise.ai/threats/cve-2026-109700-missing-authorization-vulnerability-in-elightup-meta-box  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-20. Updated: 2026-10-20  
License: CC BY 4.0 with a link back

CVE-2026-109700 · Severity: medium · CVSS 6.5 · Published 2026-10-20

Meta Box is a WordPress plugin that helps site administrators create and manage custom content fields. A broken access control vulnerability allows contributors and lower-privilege users to access or modify custom fields and pages they should not be permitted to view or edit, potentially exposing sensitive data or enabling unauthorized modifications.

Technologies: [eLightUp Meta Box – WordPress Custom Fields Framework](https://junglewise.ai/threats/technologies/meta-box-wordpress-custom-fields-framework). Vendors: [eLightUp](https://junglewise.ai/threats/vendors/elightup).

## Quick answers

**Is CVE-2026-109700 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-109700 being exploited in the wild.

**How severe is CVE-2026-109700?** Medium severity, with a CVSS score of 6.5, published 20 October 2026.

**Which products and versions are affected?** eLightUp Meta Box – WordPress Custom Fields Framework through 5.15.2.

**Is there a fix for CVE-2026-109700?** Yes: fixed in 5.15.3. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-109700 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-109700?** Check whether you run eLightUp Meta Box – WordPress Custom Fields Framework at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 5.15.3

## Technical details

A missing authorization check in Meta Box – WordPress Custom Fields Framework versions up to 5.15.2 allows users with the Contributor role (or similar lower privileges) to bypass access control restrictions on custom fields. The vulnerability stems from incorrectly configured security levels in the meta-box component. An authenticated attacker with contributor-level access can view or manipulate fields restricted to higher privilege levels without requiring elevated permissions.

## Affected products

- eLightUp Meta Box – WordPress Custom Fields Framework through 5.15.2

## Timeline

- 2026-10-20: disclosed: Published on Patchstack
- 2026-10-20: advisory

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/wordpress/plugin/meta-box/vulnerability/wordpress-meta-box-wordpress-custom-fields-framework-plugin-5-15-2-broken-access-control-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/meta-box/vulnerability/wordpress-meta-box-wordpress-custom-fields-framework-plugin-5-15-2-broken-access-control-vulnerability?_s_id=cve)

## Related threats

- [Meta Box WordPress Custom Fields Framework stored XSS](https://junglewise.ai/threats/cve-2026-123472-improper-neutralization-of-input-during-web-page-generation)
- [Meta Box WordPress Custom Fields Framework broken access control](https://junglewise.ai/threats/cve-2026-120836-missing-authorization-vulnerability-in-elightup-meta-box)
- [eLightUp Meta Box arbitrary file deletion in WordPress plugin](https://junglewise.ai/threats/cve-2026-39468-elightup-meta-box-arbitrary-file-deletion-in-wordpress-plugin)