An unauthenticated Meta Box frontend-form caller can rewrite page content and create a WordPress administrator.

On sites exposing the affected optional components, an attacker-selected object ID reaches form processing without the render-time authorization check. The attacker can replace page content with a registration shortcode that selects the administrator role and automatic login. Meta Box AIO is fixed, but fixed standalone-extension versions were not established.