Unauthenticated attackers can gain Administrator in Meta Box AIO ≤ 3.11.0 via a chained flaw: populate_via_query_string() lets GET rwmb_frontend_field_object_id override object_id without auth, and Form::process() skips user_can_edit(), enabling wp_update_post() to inject [mb_user_profile_register role=… auto_login=…]; mb-user-profile trusts these attrs. Update to Meta Box Frontend Submission 4.5.6 or higher and Meta Box User Profile 3.11.0 or higher in order to mitigate.