Live › vulnerability › CVE-2026-110010
Go to dashboardThe MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.3 lets anyone without logging in re-run a legacy data migration. This rolls custom post type or taxonomy definitions back to their pre-upgrade state, discarding administrator changes and possibly exposing restricted content to anonymous visitors.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the MB Custom Post Types & Custom Taxonomies plugin older than that were upgraded from a pre-2.0 release are exposed, since the unauthenticated migration only affects those. Sites that never ran a pre-2.0 version, or that have already updated, can skip it.
2.12.3No product ranges from the sources yet.
wp-content/plugins/ (look for the version in the plugin header) and see whether it is below 2.12.3.2.12.3 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.3 does not perform any capability or authentication check before allowing an unauthenticated request to re-run a legacy data migration, letting anyone revert a custom post type or taxonomy definition on sites upgraded from a pre-2.0 release back to its pre-upgrade state. This discards configuration changes an administrator made after upgrading and, where those changes had restricted a definition's visibility, silently re-exposes the definition and its content to anonymous visitors.
This page as .md · .json · in your agent: get_signal("CVE-2026-110010")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.