Export Feature Vulnerability in MB Custom Post Types & Custom Taxonomies Plugin by WordPress
CVE-2026-110011
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 22 October 2026
Badges
What is CVE-2026-110011?
The MB Custom Post Types & Custom Taxonomies plugin for WordPress prior to version 2.12.3 contains a vulnerability in its export feature, which fails to adequately enforce capability checks. This oversight allows users, even those with minimal roles such as Contributor, to gain unauthorized access to sensitive configuration details of admin-only custom post types and taxonomies. Additionally, these compromised users can view non-public information, including post titles, dates, statuses, and specific content from other users' private posts and pages, significantly jeopardizing user privacy and data security.
Affected Version(s)
MB Custom Post Types & Custom Taxonomies 2.4.0 < 2.12.3
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.