CVE-2026-109982 MB Custom Post Types & Custom Taxonomies CVE debrief

Who should care

Defenders responsible for WordPress installations using the MB Custom Post Types & Custom Taxonomies plugin should assess exposure and verify the version of the plugin. They should also review compensating controls for exposed systems, monitor for potential abuse, and track exceptions and remediation efforts. Security teams and vulnerability management teams should prioritize verifying the plugin version and restricting access to migration actions to and

Why it matters

Defenders should care about CVE-2026-109982 because it allows authenticated users to trigger a one-way migration that can result in data loss and unauthorized creation of published records. Verification of the plugin version and restriction of access to migration actions are necessary to prevent potential abuse.

• Potential data loss due to permanent deletion of post-type and taxonomy configuration
• Possible unauthorized creation of published records

Technical summary

The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.2 does not perform a capability check or validate a nonce on its migration actions, allowing any authenticated user to trigger a one-way migration that creates published records and permanently deletes a companion MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.2's entire post-type and taxonomy configuration. This can result in data loss and unauthorized creation of published records. Defenders should prioritize verifying the version of the MB Custom Post Types & Custom Taxonomies WordPress plugin and restricting access to migration actions.

Defensive priority

Defenders should prioritize verifying the version of the MB Custom Post Types & Custom Taxonomies WordPress plugin and restricting access to migration actions.

Recommended defensive actions

• Verify the version of the MB Custom Post Types & Custom Taxonomies WordPress plugin
• Restrict access to migration actions
• Monitor for potential abuse of migration functionality
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. Further verification is required to determine the affected versions and potential impact. The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.2 does not perform a capability check or validate a nonce on its migration actions. Defenders should verify the plugin version and assess exposure to potential abuse. Evidence from the CVE record and NVD entry suggests that authenticated users can trigger a one-way migration that creates and

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.