Live › vulnerability › CVE-2026-109982
Go to dashboardThe MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.2 lacks a capability check and nonce validation on its migration actions. Any authenticated user, including a subscriber, can trigger a one-way migration that creates published records and permanently deletes the plugin's post-type and taxonomy configuration.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the MB Custom Post Types & Custom Taxonomies plugin before 2.12.2 that allow user registration or have any authenticated users are exposed. Sites where only administrators log in, or that do not run this plugin, can skip it.
No product ranges from the sources yet.
wp plugin get mb-custom-post-types --field=version (slug assumed; confirm it matches the plugin).2.12.2 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.2 does not perform a capability check or validate a nonce on its migration actions, allowing any authenticated user, such as a subscriber, to trigger a one-way migration that creates published records and permanently deletes a companion MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.2's entire post-type and taxonomy configuration.
This page as .md · .json · in your agent: get_signal("CVE-2026-109982")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.