CVE-2026-110010 Overview
CVE-2026-110010 affects the MB Custom Post Types & Custom Taxonomies WordPress plugin in versions prior to 2.12.3. The plugin exposes a legacy data migration routine without performing any capability or authentication check. An unauthenticated attacker can trigger the migration remotely to revert custom post type or taxonomy definitions to their pre-upgrade state. On sites upgraded from a pre-2.0 release, this discards administrator configuration changes made after the upgrade. Where those changes previously restricted a definition's visibility, the rollback silently re-exposes the definition and its content to anonymous visitors. The flaw is categorized as [CWE-862] Missing Authorization.
Critical Impact
Unauthenticated attackers can revert custom post type and taxonomy definitions, silently re-exposing content that administrators had restricted after upgrade.
Affected Products
- MB Custom Post Types & Custom Taxonomies WordPress plugin versions prior to 2.12.3
- WordPress sites previously upgraded from a pre-2.0 release of the plugin
- Sites relying on post-upgrade administrator changes to restrict custom post type or taxonomy visibility
Discovery Timeline
- 2026-10-22 - CVE-2026-110010 published to the National Vulnerability Database (NVD)
- 2026-10-22 - Last updated in the NVD database
Technical Details for CVE-2026-110010
Vulnerability Analysis
The MB Custom Post Types & Custom Taxonomies plugin ships a legacy data migration routine intended to convert pre-2.0 configuration data into the current schema. The routine runs through a request handler reachable over the network. The handler does not call a WordPress capability check such as current_user_can(), nor does it validate a nonce or authenticated session. An unauthenticated HTTP request to the plugin endpoint re-executes the migration against stored configuration.
When the migration re-runs, it overwrites the current custom post type and taxonomy definitions with the state derived from legacy data. Any configuration changes an administrator saved after the original upgrade are discarded. Changes that restricted visibility, such as toggling a post type to private or removing public exposure of a taxonomy, revert to the pre-upgrade public configuration. The content behind those definitions becomes reachable to anonymous visitors again.
Root Cause
The root cause is a missing authorization check [CWE-862] on the migration entry point. The plugin trusts any caller to initiate a destructive, state-changing operation. There is no verification that the request originates from an administrator or includes a valid WordPress nonce.
Attack Vector
The attack vector is network-based. An attacker sends a crafted HTTP request to the vulnerable plugin endpoint on a target WordPress site. No authentication, user interaction, or local access is required. Successful exploitation triggers the migration server-side and modifies plugin configuration. See the WPScan Vulnerability #6727 advisory for technical details.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-110010
Indicators of Compromise
- Unexpected reversion of custom post type or taxonomy definitions to configuration values that match the pre-upgrade state.
- Previously restricted custom post types or taxonomies becoming publicly queryable through the WordPress REST API or front-end URLs.
- Web server access logs containing unauthenticated requests to the MB Custom Post Types & Custom Taxonomies plugin migration endpoint.
Detection Strategies
- Compare current wp_options entries for the plugin against a known-good backup to identify unauthorized configuration rollbacks.
- Alert on HTTP requests to plugin paths from unauthenticated sources, particularly those triggering administrative actions.
- Monitor the WordPress REST API surface for the sudden reappearance of custom post types or taxonomies that were previously set to non-public.
Monitoring Recommendations
- Enable WordPress audit logging for changes to custom post type and taxonomy registrations.
- Baseline the plugin configuration after each administrative change and alert on drift.
- Review access logs for repeated hits to plugin AJAX or admin-post endpoints from unauthenticated clients.
How to Mitigate CVE-2026-110010
Immediate Actions Required
- Upgrade the MB Custom Post Types & Custom Taxonomies plugin to version 2.12.3 or later on all WordPress sites.
- Audit custom post type and taxonomy configurations after upgrade to confirm visibility settings match the intended state.
- Review web server logs for prior requests to the plugin migration endpoint and investigate any matches.
Patch Information
The vendor fixed this issue in MB Custom Post Types & Custom Taxonomies version 2.12.3. The fix adds authorization enforcement on the legacy migration handler. Refer to the WPScan Vulnerability #6727 advisory for vendor references and the fixed version.
Workarounds
- Restrict access to the WordPress admin and plugin AJAX endpoints at the web application firewall (WAF) layer until the plugin is updated.
- Temporarily deactivate the MB Custom Post Types & Custom Taxonomies plugin on sites that cannot be patched immediately.
- Re-apply visibility restrictions to any affected custom post types and taxonomies after confirming the patched version is active.
# Configuration example: upgrade the plugin via WP-CLI
wp plugin update mb-custom-post-type --version=2.12.3
wp plugin list --name=mb-custom-post-type --fields=name,status,version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
