CVE-2026-110011 Overview
CVE-2026-110011 affects the MB Custom Post Types & Custom Taxonomies WordPress plugin in versions prior to 2.12.3. The plugin's export feature does not enforce a capability check, allowing authenticated users with a role as low as Contributor to access data they should not see. Exposed data includes the configuration of admin-only custom post types and taxonomies, along with titles, dates, statuses, and portions of stored content from other users' non-public posts and pages. The flaw maps to CWE-863: Incorrect Authorization.
Critical Impact
Low-privileged WordPress users can read non-public post metadata and partial content belonging to other authors, as well as admin-only post type and taxonomy configurations.
Affected Products
- MB Custom Post Types & Custom Taxonomies WordPress plugin versions prior to 2.12.3
- WordPress sites that allow Contributor or higher roles for untrusted users
- Multi-author WordPress deployments relying on the plugin for custom post type management
Discovery Timeline
- 2026-10-22 - CVE-2026-110011 published to the National Vulnerability Database (NVD)
- 2026-10-22 - Last updated in NVD database
Technical Details for CVE-2026-110011
Vulnerability Analysis
The vulnerability resides in the export feature of the MB Custom Post Types & Custom Taxonomies plugin. The export handler returns configuration data and stored post records without validating whether the requesting user holds the required capability. Any authenticated user with Contributor privileges or higher can trigger the export and receive data that is otherwise restricted to administrators.
The disclosed data includes custom post type and taxonomy definitions marked as admin-only. It also includes titles, publication dates, statuses, and portions of the content of other users' non-public posts and pages. This exposes draft content, scheduled announcements, and internal editorial workflows to untrusted contributors.
Root Cause
The root cause is a missing capability check in the export endpoint. The plugin relies on authentication alone and does not call current_user_can() with an administrative capability such as manage_options or export before returning sensitive data. This is a broken access control pattern classified under CWE-863.
Attack Vector
An attacker must hold a valid WordPress account with at least the Contributor role. The attacker invokes the plugin's export action over HTTP and parses the response to extract admin-only post type definitions and non-public post metadata belonging to other users. No user interaction from an administrator is required. See the WPScan Vulnerability Report for additional technical context.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-110011
Indicators of Compromise
- Unexpected requests to the plugin's export endpoint originating from Contributor or Author accounts
- WordPress access logs showing export action parameters issued by non-administrator session cookies
- Outbound responses from the plugin containing serialized post type or taxonomy configuration data to low-privileged users
Detection Strategies
- Review WordPress audit logs for export actions tied to the MB Custom Post Types & Custom Taxonomies plugin and correlate them against the invoking user's role
- Alert when accounts with roles below Editor invoke administrative plugin actions over admin-ajax.php or admin-post.php
- Baseline normal export activity by administrator accounts and flag deviations in frequency or source IP
Monitoring Recommendations
- Forward WordPress and web server logs to a centralized logging platform for role-aware correlation
- Monitor for enumeration patterns such as repeated export calls followed by access to draft or private post URLs
- Track creation of new Contributor accounts followed shortly by plugin administrative action requests
How to Mitigate CVE-2026-110011
Immediate Actions Required
- Upgrade the MB Custom Post Types & Custom Taxonomies plugin to version 2.12.3 or later on all WordPress installations
- Audit existing Contributor and Author accounts and remove any that are not actively required
- Review draft, pending, and private posts for sensitive content that may have been disclosed prior to patching
Patch Information
The vendor addressed the missing capability check in version 2.12.3 of the plugin. Site administrators should apply the update through the WordPress plugin management console or via WP-CLI. Confirm the installed version after the update and verify that export functionality is now restricted to administrative roles. Refer to the WPScan advisory for release details.
Workarounds
- Temporarily disable the MB Custom Post Types & Custom Taxonomies plugin until the patch can be applied
- Restrict Contributor and Author account provisioning and require administrator approval for new low-privilege users
- Place the WordPress admin area behind a web application firewall rule that blocks the plugin's export action for non-administrator sessions
# Update the plugin via WP-CLI
wp plugin update mb-custom-post-type --version=2.12.3
# Verify installed version
wp plugin get mb-custom-post-type --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
