CVE-2026-110011 MB Custom Post Types & Custom Taxonomies CVE debrief

Who should care

Defenders responsible for WordPress installations with the MB Custom Post Types & Custom Taxonomies plugin should assess exposure and prioritize verification of custom post type and taxonomy configurations.

Why it matters

The vulnerability allows users with a role as low as Contributor to read sensitive content via the export feature, requiring defenders to verify configurations and restrict access.

• Verification of custom post type and taxonomy configurations is required to ensure sensitive content is not exposed.
• Restricting access to sensitive content is necessary to prevent unauthorized disclosure.

Technical summary

The MB Custom Post Types & Custom Taxonomies plugin for WordPress does not perform a capability check in its export feature, allowing users with a role as low as Contributor to read the configuration of admin-only custom post types and taxonomies, as well as some stored content of other users' non-public posts and pages. The vulnerability exists in versions 2.4.0 to 2.12.2 of the plugin. Defenders should prioritize verifying the configuration of custom post types and taxonomies, and restrict access to sensitive content.

Defensive priority

Defenders should prioritize verifying the configuration of custom post types and taxonomies, and restrict access to sensitive content.

Recommended defensive actions

• Verify the configuration of custom post types and taxonomies
• Restrict access to sensitive content
• Update to version 2.12.3 or later
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Review compensating controls for exposed systems while remediation is scheduled and verified.

Evidence notes

The vulnerability exists in versions 2.4.0 to 2.12.2 of the MB Custom Post Types & Custom Taxonomies plugin. The CVE Program and NVD have records of this vulnerability. Source item cve_program_cvelist_v5 provides details on the vulnerability. Official CVE Program record with source-provided CVE metadata and Official NIST NVD detail page and source-specific vulnerability assessment are available.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.