{"id":"CVE-2026-109982","kind":"vulnerability","aliases":["CVE-2026-109982"],"related":[],"title":"WordPress MB Custom Post Types plugin: any logged-in user can wipe configuration","description":"The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.2 does not perform a capability check or validate a nonce on its migration actions, allowing any authenticated user, such as a subscriber, to trigger a one-way migration that creates published records and permanently deletes a companion MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.2's entire post-type and taxonomy configuration.","summary":"The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.2 lacks a capability check and nonce validation on its migration actions. Any authenticated user, including a subscriber, can trigger a one-way migration that creates published records and permanently deletes the plugin's post-type and taxonomy configuration.","severity":"medium","cvss":4.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress","wordpress-plugin"],"not_affected_if":["no-user-registration","plugin-version-2.12.2-or-later"],"how_to_check":"- Check the installed plugin version in the WordPress admin Plugins screen or with `wp plugin get mb-custom-post-types --field=version` (slug assumed; confirm it matches the plugin).\n- Review which accounts exist on the site; any subscriber-level account can reach the flaw.","fix":"- Update the MB Custom Post Types & Custom Taxonomies plugin to `2.12.2` or later.\n- Until updated, restrict or remove unneeded subscriber and contributor accounts.","status":"open","published_at":"2026-10-16T07:17:10+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","triaged_at":"2026-10-25T04:41:45+00:00","updated_at":"2026-10-25T04:41:45+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T04:41:45Z","model":"claude-haiku-5-5","output":{"fix":"- Update the MB Custom Post Types & Custom Taxonomies plugin to `2.12.2` or later.\n- Until updated, restrict or remove unneeded subscriber and contributor accounts.","reach":"internet","title":"WordPress MB Custom Post Types plugin: any logged-in user can wipe configuration","impact":"medium","summary":"The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.2 lacks a capability check and nonce validation on its migration actions. Any authenticated user, including a subscriber, can trigger a one-way migration that creates published records and permanently deletes the plugin's post-type and taxonomy configuration.","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"Any logged-in user deletes the site's custom post type and taxonomy configuration.","analyst_note":"","how_to_check":"- Check the installed plugin version in the WordPress admin Plugins screen or with `wp plugin get mb-custom-post-types --field=version` (slug assumed; confirm it matches the plugin).\n- Review which accounts exist on the site; any subscriber-level account can reach the flaw.","needs_analyst":false,"not_affected_if":["plugin-version-2.12.2-or-later","no-user-registration"],"who_is_affected":"Sites running the MB Custom Post Types & Custom Taxonomies plugin before 2.12.2 that allow user registration or have any authenticated users are exposed. Sites where only administrators log in, or that do not run this plugin, can skip it.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000642,"input_tokens":3374,"output_tokens":610,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-109982':17A,20A '-2026':16A,19A '2.12.2':39B,90C,138C 'action':50B,104C 'allow':105C 'authent':52B,107C 'capabl':42B,95C 'check':43B,96C 'companion':128C 'configur':14A,79B,146C 'creat':65B,121C 'custom':3A,31B,34B,82C,85C,130C,133C 'cve':15A,18A 'delet':70B,126C 'entir':140C 'host':24B 'includ':54B 'lack':40B 'log':9A 'logged-in':8A 'mb':2A,30B,81C,129C 'migrat':49B,63B,103C,119C 'nonc':45B,100C 'one':61B,117C 'one-way':60B,116C 'packag':21B 'perform':93C 'perman':69B,125C 'plugin':6A,28B,37B,72B,88C,136C 'post':4A,32B,75B,83C,131C,142C 'post-typ':74B,141C 'publish':66B,122C 'record':67B,123C 'self':23B 'self-host':22B 'subscrib':56B,112C 'taxonomi':35B,78B,86C,134C,145C 'trigger':58B,114C 'type':5A,33B,76B,84C,132C,143C 'user':11A,53B,108C 'valid':46B,98C 'way':62B,118C 'wipe':13A 'wordpress':1A,25B,27B,36B,87C,135C 'wordpress-plugin':26B","nicknames":[],"mitigations":[],"who_affected":"Sites running the MB Custom Post Types & Custom Taxonomies plugin before 2.12.2 that allow user registration or have any authenticated users are exposed. Sites where only administrators log in, or that do not run this plugin, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T07:17:10+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-109982","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109982","severity":null,"published_at":"2026-10-16T07:17:10+00:00","modified_at":"2026-10-16T15:17:08+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}