CVE-2026-39468: Elightup Meta Box – WordPress Custom Fields Framework

Medium severity, CVSS 6.8. EPSS: 1.3% chance of exploitation in the next 30 days.

Contributor Arbitrary File Deletion in Meta Box – WordPress Custom Fields Framework <= 5.11.1 versions.

Affected products

• Elightup Meta Box – WordPress Custom Fields Framework: up to and including 5.11.1

Published 2026-06-15. Last modified 2026-06-17.