Remove meta boxes per user role <= 1.01 - Cross-Site Request Forgery to Settings Update
mediumThe Remove meta boxes per user role plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.01. This is due to missing or incorrect nonce validation on the 'remove-meta-boxes-per-user-role' page. This makes it possible for unauthenticated attackers to modify or reset the...
- CVSS:
- 4.3
- Affected:
- up to 1.01
- Fix:
- No patched version reported
- Disclosed:
- Jun 1, 2026