CVE-2026-8422: Cross-Site Request Forgery in Remove Meta Boxes Per User Role WordPress Plugin

Technical summary

CVE-2026-8422 is a Cross-Site Request Forgery (CSRF) vulnerability in the Remove meta boxes per user role plugin for WordPress. The plugin fails to implement or properly validate nonce tokens on the 'remove-meta-boxes-per-user-role' administrative page. This allows an unauthenticated attacker to craft a forged HTTP request that, when executed in an authenticated admin's browser session, modifies the plugin's per-role meta box visibility configuration. The vulnerability is classified as CWE-352 (Cross-Site Request Forgery) and carries a CVSS 3.1 score of 4.3 (Medium severity) with a vector reflecting network-based attack, low complexity, no privilege requirement, required user interaction, and integrity impact limited to the plugin's settings scope.

Business impact

A successful CSRF attack could disrupt site administrator workflows by hiding or resetting critical content panels that administrators rely on for editing and management. While the impact is bounded to the plugin's configuration layer, repeated or coordinated attacks could degrade trust in site administration and create operational confusion. The vulnerability does not expose sensitive data or enable privilege escalation, but it does undermine the integrity of administrative preferences.

Affected systems

WordPress installations running the Remove meta boxes per user role plugin in any version up to and including 1.01. The plugin must be installed and activated for the vulnerability to be present. No vulnerability data indicates specific WordPress versions, themes, or other plugins are inherently more vulnerable; however, sites with high-value or frequently-targeted administrative accounts face elevated risk.

Exploitability

Exploitation requires social engineering: an attacker must craft a malicious link or embed a hidden request in a webpage and trick a site administrator into visiting it while logged into WordPress. The attack surface is limited by the need for user interaction and valid admin session, but the barrier to entry is low—a basic understanding of HTML forms suffices. This vulnerability is not in the CISA Known Exploited Vulnerabilities (KEV) catalog, indicating no widespread active exploitation has been reported as of the modification date.

Remediation

Update the Remove meta boxes per user role plugin to a patched version released after version 1.01. Site administrators should check the plugin's repository or vendor advisories for the latest available release. As an interim measure, restrict administrative access to trusted networks or require additional authentication factors to reduce the likelihood of successful social engineering.

Patch guidance

Verify the latest version of the Remove meta boxes per user role plugin available in the WordPress Plugin Directory or from the plugin vendor's official source. Update immediately upon confirmation that a patched version addressing CSRF validation is available. Test the update in a staging environment before deploying to production to ensure compatibility with your site's configuration and other active plugins.

Detection guidance

Monitor web server logs for suspicious POST requests to the 'remove-meta-boxes-per-user-role' page originating from unusual referrers or user agents. Review WordPress admin activity logs to identify unexpected changes to meta box visibility settings, particularly if they coincide with reports of administrator confusion or unintended configuration drift. WordPress security plugins offering request logging can help surface CSRF attempts by flagging requests without valid nonce tokens.

Why prioritize this

Although this vulnerability carries a Medium CVSS score and requires user interaction to exploit, it should be prioritized for timely patching because it undermines the integrity of site administration interfaces and can be weaponized in targeted social engineering campaigns against site administrators. The ease of exploitation, combined with the broad attack surface of administrator-targeted phishing, justifies prompt remediation even in low-threat environments.

Risk score, explained

The CVSS 3.1 score of 4.3 reflects a network-accessible vulnerability requiring no authentication but mandating user interaction (UI:R). The integrity impact is limited (I:L) to the plugin's per-role settings, with no confidentiality or availability impact. The score appropriately balances the ease of delivery against the contained scope of the damage, landing it in the Medium severity band.

Frequently asked questions