# CVE-2026-39468: eLightUp Meta Box arbitrary file deletion in WordPress plugin

Source: https://junglewise.ai/threats/cve-2026-39468-elightup-meta-box-arbitrary-file-deletion-in-wordpress-plugin  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-15. Updated: 2026-06-15  
License: CC BY 4.0 with a link back

CVE-2026-39468 · Severity: medium · CVSS 6.8 · Published 2026-06-15

Meta Box is a popular WordPress plugin used by developers to create custom data fields and metadata for websites. A security flaw in this plugin allows users with 'Contributor' level access to delete arbitrary files from the web server. This could lead to a complete website failure or the removal of critical configuration files, potentially disrupting business operations and requiring manual restoration from backups.

Technologies: [eLightUp Meta Box – WordPress Custom Fields Framework](https://junglewise.ai/threats/technologies/meta-box-wordpress-custom-fields-framework). Vendors: [eLightUp](https://junglewise.ai/threats/vendors/elightup).

## Quick answers

**Is CVE-2026-39468 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-39468 being exploited in the wild.

**How severe is CVE-2026-39468?** Medium severity, with a CVSS score of 6.8, published 15 June 2026.

**Which products and versions are affected?** eLightUp Meta Box – WordPress Custom Fields Framework <= 5.11.1.

**Is there a fix for CVE-2026-39468?** A patch was published on 2026-04-13: Version 5.11.2 released to address the issue Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-39468 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-39468?** Check whether you run eLightUp Meta Box – WordPress Custom Fields Framework at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Meta Box plugin for WordPress (versions up to and including 5.11.1) is vulnerable to arbitrary file deletion. This issue stems from a path traversal vulnerability (CWE-22) where the application fails to properly sanitize user-supplied input used to identify files for deletion. An attacker with Contributor-level privileges can exploit this to delete sensitive files outside of the intended directory, such as wp-config.php or .htaccess, potentially leading to a Denial of Service (DoS) or site takeover. The vulnerability is addressed in version 5.11.2.

## Affected products

- eLightUp Meta Box – WordPress Custom Fields Framework <= 5.11.1

## Timeline

- 2026-01-27: other: Vulnerability reported by Nguyen Ba Khanh
- 2026-04-13: advisory: Initial advisory published by Patchstack
- 2026-04-13: patched: Version 5.11.2 released to address the issue
- 2026-06-15: disclosed: CVE published to NVD

## References

- [https://patchstack.com/database/wordpress/plugin/meta-box/vulnerability/wordpress-meta-box-wordpress-custom-fields-framework-plugin-5-11-1-arbitrary-file-deletion-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/meta-box/vulnerability/wordpress-meta-box-wordpress-custom-fields-framework-plugin-5-11-1-arbitrary-file-deletion-vulnerability?_s_id=cve)

## Related threats

- [Meta Box WordPress Custom Fields Framework stored XSS](https://junglewise.ai/threats/cve-2026-123472-improper-neutralization-of-input-during-web-page-generation)
- [Meta Box WordPress Custom Fields Framework broken access control](https://junglewise.ai/threats/cve-2026-120836-missing-authorization-vulnerability-in-elightup-meta-box)
- [Meta Box missing authorization in custom fields access control](https://junglewise.ai/threats/cve-2026-109700-missing-authorization-vulnerability-in-elightup-meta-box)