{"id":"CVE-2026-110010","kind":"vulnerability","aliases":["CVE-2026-110010"],"related":[],"title":"WordPress MB Custom Post Types plugin: unauthenticated request reverts post type settings","description":"The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.3 does not perform any capability or authentication check before allowing an unauthenticated request to re-run a legacy data migration, letting anyone revert a custom post type or taxonomy definition on sites upgraded from a pre-2.0 release back to its pre-upgrade state. This discards configuration changes an administrator made after upgrading and, where those changes had restricted a definition's visibility, silently re-exposes the definition and its content to anonymous visitors.","summary":"The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.3 lets anyone without logging in re-run a legacy data migration. This rolls custom post type or taxonomy definitions back to their pre-upgrade state, discarding administrator changes and possibly exposing restricted content to anonymous visitors.","severity":"medium","cvss":4.8,"epss":0.00168,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","wordpress","wordpress-plugin"],"not_affected_if":["already-updated","fresh-install-2.0-or-later"],"how_to_check":"- Check the installed plugin version in the WordPress admin plugins list or in `wp-content/plugins/` (look for the version in the plugin header) and see whether it is below `2.12.3`.\n- Check whether the site was upgraded from a pre-2.0 release of the plugin, since the migration only applies to those sites.","fix":"- Update the MB Custom Post Types & Custom Taxonomies plugin to `2.12.3` or later.","status":"open","published_at":"2026-10-22T06:17:13+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-25T04:33:05+00:00","updated_at":"2026-10-25T04:33:05+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T04:33:05Z","model":"claude-haiku-5-5","output":{"fix":"- Update the MB Custom Post Types & Custom Taxonomies plugin to `2.12.3` or later.","reach":"internet","title":"WordPress MB Custom Post Types plugin: unauthenticated request reverts post type settings","impact":"medium","summary":"The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.3 lets anyone without logging in re-run a legacy data migration. This rolls custom post type or taxonomy definitions back to their pre-upgrade state, discarding administrator changes and possibly exposing restricted content to anonymous visitors.","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin"],"confidence":0.7,"needs_auth":"no","worst_case":"Anonymous visitors see custom post types and their content that admins had restricted.","analyst_note":"","how_to_check":"- Check the installed plugin version in the WordPress admin plugins list or in `wp-content/plugins/` (look for the version in the plugin header) and see whether it is below `2.12.3`.\n- Check whether the site was upgraded from a pre-2.0 release of the plugin, since the migration only applies to those sites.","needs_analyst":false,"not_affected_if":["fresh-install-2.0-or-later","already-updated"],"who_is_affected":"Sites running the MB Custom Post Types & Custom Taxonomies plugin older than `2.12.3` that were upgraded from a pre-2.0 release are exposed, since the unauthenticated migration only affects those. Sites that never ran a pre-2.0 version, or that have already updated, can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000644,"input_tokens":3442,"output_tokens":599,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-110010':15A,18A '-2.0':121C '-2026':14A,17A '2.12.3':34B,83C 'administr':63B,135C 'allow':93C 'anonym':71B,159C 'anyon':36B,106C 'authent':90C 'back':55B,123C 'capabl':88C 'chang':64B,133C,142C 'check':91C 'configur':132C 'content':69B,157C 'custom':3A,26B,29B,49B,75C,78C,109C 'cve':13A,16A 'data':45B,103C 'definit':54B,114C,146C,154C 'discard':62B,131C 'expos':67B,152C 'legaci':44B,102C 'let':35B,105C 'log':38B 'made':136C 'mb':2A,25B,74C 'migrat':46B,104C 'packag':19B 'perform':86C 'plugin':6A,23B,32B,81C 'possibl':66B 'post':4A,10A,27B,50B,76C,110C 'pre':59B,120C,127C 'pre-upgrad':58B,126C 're':41B,99C,151C 're-expos':150C 're-run':40B,98C 'releas':122C 'request':8A,96C 'restrict':68B,144C 'revert':9A,107C 'roll':48B 'run':42B,100C 'set':12A 'silent':149C 'site':116C 'state':61B,129C 'taxonomi':30B,53B,79C,113C 'type':5A,11A,28B,51B,77C,111C 'unauthent':7A,95C 'upgrad':60B,117C,128C,138C 'visibl':148C 'visitor':72B,160C 'without':37B 'wordpress':1A,20B,22B,31B,80C 'wordpress-plugin':21B","nicknames":[],"mitigations":[],"who_affected":"Sites running the MB Custom Post Types & Custom Taxonomies plugin older than `2.12.3` that were upgraded from a pre-2.0 release are exposed, since the unauthenticated migration only affects those. Sites that never ran a pre-2.0 version, or that have already updated, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T06:17:13+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110010","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110010","severity":null,"published_at":"2026-10-22T06:17:13+00:00","modified_at":"2026-10-22T15:16:14+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-110010","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110010","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:52+00:00","fetched_at":"2026-10-24T07:15:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}