{"id":"CVE-2026-110011","kind":"vulnerability","aliases":["CVE-2026-110011"],"related":[],"title":"MB Custom Post Types WordPress plugin: export leaks non-public posts to contributors","description":"The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.3 does not perform a capability check in its export feature, allowing users with a role as low as Contributor to read the configuration of admin-only custom post types and taxonomies, as well as the titles, dates, statuses and some stored content of other users' non-public posts and pages.","summary":"The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.3 lacks a capability check in its export feature. A user with a Contributor role or higher can read admin-only post type and taxonomy configuration and the titles, dates, statuses and some content of other users' non-public posts and pages.","severity":"low","cvss":2.7,"epss":0.00179,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","wordpress","wordpress-plugin"],"not_affected_if":["plugin-version-2.12.3-or-later"],"how_to_check":"- Check the installed plugin version in the WordPress admin plugins list or with `wp plugin get custom-post-type-ui-extended` (plugin slug unknown from sources; confirm the slug)\n- Confirm whether the export feature of the plugin is in use by reviewing the plugin's admin menu","fix":"- Update the MB Custom Post Types & Custom Taxonomies plugin to `2.12.3` or later","status":"open","published_at":"2026-10-22T06:17:14+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-25T04:47:58+00:00","updated_at":"2026-10-25T04:47:58+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T04:47:58Z","model":"claude-haiku-5-5","output":{"fix":"- Update the MB Custom Post Types & Custom Taxonomies plugin to `2.12.3` or later","reach":"network","title":"MB Custom Post Types WordPress plugin: export leaks non-public posts to contributors","impact":"low","summary":"The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.3 lacks a capability check in its export feature. A user with a Contributor role or higher can read admin-only post type and taxonomy configuration and the titles, dates, statuses and some content of other users' non-public posts and pages.","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin"],"confidence":0.7,"needs_auth":"yes","worst_case":"Contributor-role users read private post data and admin-only post type settings","analyst_note":"","how_to_check":"- Check the installed plugin version in the WordPress admin plugins list or with `wp plugin get custom-post-type-ui-extended` (plugin slug unknown from sources; confirm the slug)\n- Confirm whether the export feature of the plugin is in use by reviewing the plugin's admin menu","needs_analyst":false,"not_affected_if":["plugin-version-2.12.3-or-later"],"who_is_affected":"Sites running the MB Custom Post Types & Custom Taxonomies plugin before `2.12.3` where users with the Contributor role or higher can access the plugin's export feature. Sites without the plugin, or already on `2.12.3` or later, are not affected.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"low"},"cost_usd":0.000617,"input_tokens":3380,"output_tokens":558,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-110011':17A,20A '-2026':16A,19A '2.12.3':36B,90C 'admin':56B,116C 'admin-on':55B,115C 'allow':101C 'capabl':39B,95C 'check':40B,96C 'configur':62B,113C 'content':70B,133C 'contributor':14A,49B,109C 'custom':2A,28B,31B,82C,85C,118C 'cve':15A,18A 'date':66B,128C 'export':7A,43B,99C 'featur':44B,100C 'higher':52B 'lack':37B 'leak':8A 'low':107C 'mb':1A,27B,81C 'non':10A,75B,138C 'non-publ':9A,74B,137C 'packag':21B 'page':79B,142C 'perform':93C 'plugin':6A,25B,34B,88C 'post':3A,12A,29B,58B,77B,83C,119C,140C 'public':11A,76B,139C 'read':54B,111C 'role':50B,105C 'status':67B,129C 'store':132C 'taxonomi':32B,61B,86C,122C 'titl':65B,127C 'type':4A,30B,59B,84C,120C 'user':46B,73B,102C,136C 'well':124C 'wordpress':5A,22B,24B,33B,87C 'wordpress-plugin':23B","nicknames":[],"mitigations":[],"who_affected":"Sites running the MB Custom Post Types & Custom Taxonomies plugin before `2.12.3` where users with the Contributor role or higher can access the plugin's export feature. Sites without the plugin, or already on `2.12.3` or later, are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T06:17:14+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110011","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110011","severity":null,"published_at":"2026-10-22T06:17:14+00:00","modified_at":"2026-10-22T15:16:14+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-110011","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110011","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:52+00:00","fetched_at":"2026-10-24T07:15:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}