CVE-2026-110011 Details
Description
The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.3 does not perform a capability check in its export feature, allowing users with a role as low as Contributor to read the configuration of admin-only custom post types and taxonomies, as well as the titles, dates, statuses and some stored content of other users' non-public posts and pages.
A vulnerability exists in the MB Custom Post Types & Custom Taxonomies WordPress plugin in versions prior to 2.12.3. The issue arises because the plugin's export feature lacks proper capability checks. This flaw enables users with a minimum role of Contributor to access and read the configurations of admin-only custom post types and taxonomies. Additionally, it allows them to view titles, dates, statuses, and certain content from non-public posts and pages belonging to other users.
Users are advised to update the MB Custom Post Types & Custom Taxonomies WordPress plugin to version 2.12.3 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 22, 2026CISA-ADP
Assessed Oct 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://wpscan.com/vulnerability/4a9a982d-cbf7-4125-b35c-7dd8af40e745/ | [email protected] | AdvisoryPartial ContentRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-863 | Incorrect Authorization | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| MB Custom Post Types & Custom Taxonomies | >= 2.4.0, <= 2.12.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 22, 2026 | CVE Modified | CISA-ADP |
| Oct 22, 2026 | New CVE Received | [email protected] |