Incorrect Version Number in WordFence and Patchstack Vulnerability Database

This topic has 4 replies, 3 voices, and was last updated 1 week, 5 days ago by Johannes Gross.

Viewing 5 posts - 1 through 5 (of 5 total)

Author

Posts
September 24, 2026 at 3:39 AM #50211

Johannes Gross
Participant

Hello,

WordFence and Patchstack report that the Meta Box User Profile plugin is vulnerable <= 3.11.0. However, the newest version is 2.6.0.
https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/meta-box-aio/meta-box-aio-372-and-standalone-plugin-extensions-unauthenticated-privilege-escalation-to-administrator-to-rwmb-frontend-field-object-id-parameter (listed in their description)
https://patchstack.com/database/wordpress/plugin/mb-user-profile/vulnerability/wordpress-meta-box-aio-plugin-3-11-0-and-standalone-plugin-extensions-unauthenticated-privilege-escalation-to-administrator-to-rwmb-frontend-field-object-id-parameter-vulnerability

Looks like they mixed up the version number with AIO.

Can you see if you can get this corrected? It is triggering alert to my clients even though I am running the newest version.

Add New Note to this Reply

September 24, 2026 at 9:06 PM #50214

Peter
Moderator

Hello Johannes,

Thanks for reaching out and for your feedback.

I've escalated the security issue to the development team to fix it in the next update of Meta Box plugins. It should be released as soon as possible.

Add New Note to this Reply

September 25, 2026 at 4:44 AM #50217

Johannes Gross
Participant

Maybe this would be an option especially if the vulnerability is fixed: Release a bogus update that changes the version of Meta Box User Profile to 3.12.0. This way, you don't need work with Wordfence/Patchstack's support.

Add New Note to this Reply

September 25, 2026 at 9:47 AM #50218

Anh Tran
Keymaster

Hi Johannes,

We got reports from WordFence and they created 3 separate tickets for 3 plugins: AIO, Frontend Submission & User Profile. And they use only 1 version from AIO 🙁

Increasing versions for individual plugins seems awkward, since it's not our fault, and that raise questions for other customers, too.

We'll comment about the version in the tickets to let them know and change that. We have no tickets from Patchstack, probably they copied from WordFence.

Add New Note to this Reply

October 6, 2026 at 12:37 AM #50230

Johannes Gross
Participant

Thank you for your help! While Patchstack and Wordfence made some edits, the wrong Meta Box User Profile version number still shows up on: https://www.wordfence.com/threat-intel/vulnerabilities/detail/meta-box-aio-372-and-standalone-plugin-extensions-unauthenticated-privilege-escalation-to-administrator-to-rwmb-frontend-field-object-id-parameter-2 (below 3 affected software packages).

Do you mind reaching out to them once more?

Add New Note to this Reply
Author

Posts

Viewing 5 posts - 1 through 5 (of 5 total)

You must be logged in to reply to this topic.