What’s Vulnerable › Vulnerabilities

CVE-2023-5426: Post Meta Data Manager <=1.2.0 - Missing Authorization to User, Term, and Post Meta Deletion

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-10-28 · updated 2026-06-17
• Weakness: CWE-862

Description

The Post Meta Data Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the pmdm_wp_delete_user_meta, pmdm_wp_delete_term_meta, and pmdm_wp_ajax_delete_meta functions in versions up to, and including, 1.2.0. This makes it possible for unauthenticated attackers to delete user, term, and post meta belonging to arbitrary users.

Affected products

• gandhihitesh9 Post Meta Data Manager: before 1.2.1 — fixed in 1.2.1

How to fix

Upgrade to a fixed version: gandhihitesh9 Post Meta Data Manager 1.2.1. Check the vendor advisory for mitigations.

References

• https://plugins.trac.wordpress.org/changeset/2981559/post-meta-data-manager
• https://www.wordfence.com/threat-intel/vulnerabilities/id/d6a7f882-4582-4b08-9597-329d140ad782?source=cve
• https://plugins.trac.wordpress.org/changeset/2981559/post-meta-data-manager
• https://www.wordfence.com/threat-intel/vulnerabilities/id/d6a7f882-4582-4b08-9597-329d140ad782?source=cve

Get alerted when CVE-2023-5426 or the next vulnerability affects your stack