CVE-2025-14675: 
PHP vulnerability analysis and mitigation

CVE-2025-14675 is an arbitrary file deletion vulnerability in the Meta Box plugin for WordPress, caused by insufficient file path validation in the ajax_delete_file function. It affects all versions of the plugin up to and including 5.11.1. Authenticated attackers with Contributor-level access or above can exploit this flaw to delete arbitrary files on the server, which can lead to remote code execution (e.g., by deleting wp-config.php to trigger WordPress reinstallation). The vulnerability was disclosed on March 7, 2026, and carries a CVSS v3.1 base score of 7.2 (High) (Wordfence, Red Hat CVE).

The root cause is a path traversal vulnerability (CWE-22) in the ajax_delete_file function within the Meta Box plugin's file field handler (inc/fields/file.php). The function fails to properly validate or restrict the file path supplied by the user, allowing an attacker to craft a request that traverses outside the intended upload directory and targets arbitrary files on the server. The fix, merged on February 11, 2026, validates that the file path resides within the WordPress upload directory before performing any deletion (GitHub PR #1654, Plugin Changeset).

Successful exploitation allows an authenticated attacker (Contributor role or higher) to delete any file accessible to the web server process, including critical WordPress configuration files such as wp-config.php. Deleting wp-config.php can force WordPress into a setup/reinstallation state, enabling an attacker to reconfigure the database connection and achieve full remote code execution and site takeover. This results in high impact to confidentiality, integrity, and availability of the affected WordPress installation (Wordfence, Red Hat CVE).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-14675 as of the available data. The EPSS score is approximately 0.89%, indicating a relatively low (but non-negligible) probability of exploitation in the near term. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires at minimum a Contributor-level WordPress account, which limits the attack surface compared to unauthenticated vulnerabilities (Wordfence).

1. Reconnaissance: Identify WordPress sites running the Meta Box plugin version ≤ 5.11.1 using tools like WPScan or by inspecting plugin directories/readme files.
2. Obtain Contributor Access: Register or compromise a WordPress account with at least Contributor-level privileges (e.g., via credential stuffing, phishing, or exploiting open registration).
3. Craft Malicious AJAX Request: Send an authenticated POST request to the WordPress AJAX endpoint (/wp-admin/admin-ajax.php) targeting the ajax_delete_file action, supplying a path-traversal payload in the file parameter (e.g., ../../wp-config.php) to reference files outside the upload directory.
4. Delete Critical File: The server processes the request without proper path validation and deletes the targeted file (e.g., wp-config.php).
5. Achieve Remote Code Execution: With wp-config.php deleted, WordPress enters its installation wizard. The attacker navigates to the site, reconfigures the database connection to an attacker-controlled database, and gains administrative access — enabling arbitrary PHP code execution via theme/plugin editors or other admin features (Wordfence, GitHub PR #1654).

• Logs: WordPress access logs showing authenticated POST requests to /wp-admin/admin-ajax.php with action=rwmb_delete_file (or similar Meta Box AJAX action) and file parameters containing path traversal sequences (e.g., ../, %2e%2e%2f).
• File System: Unexpected absence of critical files such as wp-config.php, .htaccess, or other core WordPress files; timestamps of file deletions correlating with suspicious AJAX requests.
• Logs: PHP error logs or WordPress debug logs showing file deletion operations outside the wp-content/uploads directory.
• Network: Unusual POST requests to the AJAX endpoint from low-privilege user accounts, especially if followed by requests to the WordPress installation wizard (/wp-admin/install.php).

Update the Meta Box plugin to version 5.11.2 or later, which includes the security fix that validates file paths against the WordPress upload directory before deletion (Plugin Changeset, GitHub PR #1654). If immediate update is not possible, consider restricting Contributor-level user registration and auditing existing Contributor accounts. Site administrators should also ensure file system permissions limit the web server's ability to delete files outside the wp-content/uploads directory as a defense-in-depth measure.

Wordfence disclosed the vulnerability and assigned it a CVSS score of 7.2 (High), noting the potential for RCE via wp-config.php deletion (Wordfence). Sucuri included the vulnerability in their March 2026 patch roundup, highlighting it as a notable WordPress plugin security issue (Sucuri Blog). RedPacket Security and several threat intelligence aggregators flagged the CVE shortly after disclosure, and it was tracked by ENISA's EUVD database (Red Hat CVE).