The Meta Box plugin for WordPress is vulnerable to arbitrary file deletion due insufficient path validation in the 'ajax_delete_file' function all versions up to, and including, 5.11.1. This makes it possible authenticated attackers, with Contributor-level access above, delete files on server, which can easily lead remote code execution when right deleted (such as wp-config.php).