Live › vulnerability › CVE-2026-110011
Go to dashboardThe MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.3 lacks a capability check in its export feature. A user with a Contributor role or higher can read admin-only post type and taxonomy configuration and the titles, dates, statuses and some content of other users' non-public posts and pages.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the MB Custom Post Types & Custom Taxonomies plugin before 2.12.3 where users with the Contributor role or higher can access the plugin's export feature. Sites without the plugin, or already on or later, are not affected.
2.12.3No product ranges from the sources yet.
wp plugin get custom-post-type-ui-extended (plugin slug unknown from sources; confirm the slug)2.12.3 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.3 does not perform a capability check in its export feature, allowing users with a role as low as Contributor to read the configuration of admin-only custom post types and taxonomies, as well as the titles, dates, statuses and some stored content of other users' non-public posts and pages.
This page as .md · .json · in your agent: get_signal("CVE-2026-110011")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.