CVE-2026-39761

{
  "etk_id": "ETK-2026-756",
  "cve_id": "CVE-2026-39761",
  "display_id": "CVE-2026-39761",
  "ghsa_id": "GHSA-4v6j-5867-cj5q",
  "euvd_id": "EUVD-2026-93269",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unauthenticated privilege escalation in Meta Box AIO",
  "summary": "Meta Box AIO through version 3.7.1 is affected by an unauthenticated privilege-escalation vulnerability. An attacker may be able to gain elevated privileges without an existing account; the evidence provides no additional precondition.",
  "mitigation": "Disable or remove Meta Box AIO on affected sites until the vendor provides an updated release. Restrict public access to sites using the plugin where disabling it is not immediately possible.",
  "vendor": "eLightUp",
  "product": "Meta Box AIO",
  "affected": [
    {
      "affected_notes": [
        ">= n/a, <= 3.7.1"
      ],
      "affected_ranges": [],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "meta-box-aio",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 9.8,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": 0.0048,
  "epss_percentile": 0.4032,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "assessed",
  "exploit": false,
  "pipeline_minutes": 95.22499806666667,
  "t0_at": "2026-10-06T08:34:27.505000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-06T11:37:15.131015+00:00",
      "days": 0.12694011591435186,
      "is_lower_bound": false,
      "measured_at": "2026-10-06T08:34:27.505000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-06T08:34:27.505000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-06T08:34:27.505000+00:00",
      "url": "https://github.com/advisories/GHSA-4v6j-5867-cj5q"
    }
  }
}