CVE-2026-14488 affects the Meta Box AIO plugin for WordPress, specifically the MB Frontend Submission extension in versions up to and including 3.8.0. The vulnerability is a Missing Authorization flaw in the template_redirect dispatcher. The handle_request() function routes the mbfs_delete action without any capability or ownership verification. Additionally, nonce verification in check_ajax() is bypassed because is_ajax() returns false for template_redirect requests. This allows unauthenticated attackers to delete arbitrary posts and pages by supplying an attacker-controlled post ID via the rwmb_frontend_field_object_id GET parameter. The attack can be executed on any page hosting a frontend submission form, regardless of whether the allow_delete option is enabled. This represents a critical content integrity risk for WordPress sites using this plugin.