CVE-2026-3173

Vulnerability

The Meta Field Block plugin for WordPress (all versions up to and including 1.5.1) contains an Insecure Direct Object Reference (IDOR) vulnerability in its block rendering functionality. The plugin allows users to specify arbitrary object IDs and object types via block attributes without validating whether the authenticated user has permission to access the requested object's metadata [1][2]. This affects the meta-field-block.php component which processes block attributes and retrieves metadata for display.

Exploitation

An attacker must have at least Contributor-level access to a WordPress site where the Meta Field Block plugin is active and enabled. The attacker crafts or modifies a block instance, setting arbitrary objectID and objectType attributes to target specific database objects (e.g., a user ID, post ID, or term ID). When the block renders, the plugin fetches metadata from the specified object without checking the current user's capabilities on that object [1][2]. No additional privileges or user interaction beyond the initial authentication is required.

Impact

Successful exploitation allows the attacker to read arbitrary user_meta, post_meta, and term_meta from any object in the database. This can expose Personally Identifiable Information (PII) such as names, email addresses, phone numbers, and physical addresses, especially on sites using plugins that store sensitive data in meta fields (e.g., WooCommerce billing/shipping information). The attacker does not gain write access or direct system control, but the confidentiality breach can lead to further privacy violations or targeted attacks.

Mitigation

As of the publication date (2026-05-28), no patched version has been released for the Meta Field Block plugin; the vulnerable line persists in version 1.5.3 [1][2]. Administrators should disable the plugin until a security update is provided. No workaround is available beyond removing the plugin entirely. The vulnerability is not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog.