---
id: "CVE-2026-110011"
kind: "vulnerability"
aliases: ["CVE-2026-110011"]
title: "MB Custom Post Types WordPress plugin: export leaks non-public posts to contributors"
severity: "low"
cvss: 2.7
epss: 0.00179
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "wordpress", "wordpress-plugin"]
not_affected_if: ["plugin-version-2.12.3-or-later"]
published_at: "2026-10-22T06:17:14+00:00"
first_seen_at: "2026-10-23T21:57:30+00:00"
updated_at: "2026-10-25T04:47:58+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110011", "first_seen_at": "2026-10-23T21:57:30+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-110011", "first_seen_at": "2026-10-24T07:15:52+00:00"}]
---

# MB Custom Post Types WordPress plugin: export leaks non-public posts to contributors

The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.3 lacks a capability check in its export feature. A user with a Contributor role or higher can read admin-only post type and taxonomy configuration and the titles, dates, statuses and some content of other users' non-public posts and pages.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed plugin version in the WordPress admin plugins list or with `wp plugin get custom-post-type-ui-extended` (plugin slug unknown from sources; confirm the slug)
- Confirm whether the export feature of the plugin is in use by reviewing the plugin's admin menu

## Fix

- Update the MB Custom Post Types & Custom Taxonomies plugin to `2.12.3` or later

## Timeline

- 2026-10-23T21:57:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-110011
- 2026-10-24T07:15:52+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-110011

## From the sources

The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.3 does not perform a capability check in its export feature, allowing users with a role as low as Contributor to read the configuration of admin-only custom post types and taxonomies, as well as the titles, dates, statuses and some stored content of other users' non-public posts and pages.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_