CVE-2026-110010: MB Custom Post Types & Custom Taxonomies 2.0.2 - 2.12.2 - Unauthenticated Settings Reset via 'mbcpt-force' Parameter
The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.3 does not perform any capability or authentication check before allowing an unauthenticated request to re-run a legacy data migration, letting anyone revert a custom post type or taxonomy definition on sites upgraded from a pre-2.0 release back to its pre-upgrade state. This discards configuration changes an administrator made after upgrading and, where those changes had restricted a definition's visibility, silently re-exposes the definition and its content to anonymous visitors.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MB Custom Post Types & Custom Taxonomiesto a version that resolves this vulnerability.Fixed in 2.12.3
Event History
Frequently Asked Questions
Which sites face the greatest impact from this issue?
Sites that were upgraded from a pre-2.0 release are affected by the legacy migration behavior. Impact is greatest where administrators changed custom post type or taxonomy settings after upgrading, particularly changes that restricted visibility.
Does an attacker need a WordPress account to trigger the reset?
No. The migration can be re-run through an unauthenticated request because the affected plugin does not perform authentication or capability checks.
How can an administrator determine whether a site may have been exposed?
Check whether the plugin version is earlier than 2.12.3 and whether the site was upgraded from a pre-2.0 version. Review custom post type and taxonomy definitions for settings that have reverted to their pre-upgrade state, including unexpected public visibility.
What should be done to remediate the issue?
Update the plugin to version 2.12.3 or later. After updating, review and restore any custom post type or taxonomy configuration changes that may have been reverted.