CVE-2026-109982: MB Custom Post Types & Custom Taxonomies < 2.12.2 - Subscriber+ Missing Authorization via CPT UI Migration

Q: Which users can exploit this issue?

Any authenticated user can trigger the vulnerable migration actions, including users with only the Subscriber role. No elevated administrative capability is required.

Q: What is the impact of triggering the migration?

The migration is one-way: it creates published records and permanently deletes the plugin's entire post-type and taxonomy configuration.

Q: Are sites affected if users cannot log in?

The described attack requires authentication. Sites where untrusted users cannot obtain or use accounts are not exposed to exploitation by unauthenticated visitors.

Published Oct 16, 2026

Updated

The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.2 does not perform a capability check or validate a nonce on its migration actions, allowing any authenticated user, such as a subscriber, to trigger a one-way migration that creates published records and permanently deletes a companion MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.2's entire post-type and taxonomy configuration.

Affected Software

1 affected component

Meta Box MB Custom Post Types & Custom Taxonomies<2.12.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade MB Custom Post Types & Custom Taxonomies to a version that resolves this vulnerability.
Fixed in 2.12.2

Event History

Oct 16, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Which users can exploit this issue?

Any authenticated user can trigger the vulnerable migration actions, including users with only the Subscriber role. No elevated administrative capability is required.

What is the impact of triggering the migration?

The migration is one-way: it creates published records and permanently deletes the plugin's entire post-type and taxonomy configuration.

Are sites affected if users cannot log in?

The described attack requires authentication. Sites where untrusted users cannot obtain or use accounts are not exposed to exploitation by unauthenticated visitors.

CVE-2026-109982: MB Custom Post Types & Custom Taxonomies < 2.12.2 - Subscriber+ Missing Authorization via CPT UI Migration

Affected Software

Remediation

Event History

Frequently Asked Questions

Which users can exploit this issue?

What is the impact of triggering the migration?

Are sites affected if users cannot log in?

Company

Resources

Contact

Frequently Asked Questions

Which users can exploit this issue?

What is the impact of triggering the migration?

Are sites affected if users cannot log in?