CVE-2026-110010
Description
The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.3 does not perform any capability or authentication check before allowing an unauthenticated request to re-run a legacy data migration, letting anyone revert a custom post type or taxonomy definition on sites upgraded from a pre-2.0 release back to its pre-upgrade state. This discards configuration changes an administrator made after upgrading and, where those changes had restricted a definition's visibility, silently re-exposes the definition and its content to anonymous visitors.
How to fix
- MB Custom Post Types & Custom Taxonomies2.12.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| MB Custom Post Types & Custom Taxonomies | 2.0.2 ≤ v < 2.12.3 | 2.12.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.