MB Custom Post Types CVE-2026-109982

Requires an authenticated account at any privilege level (subscriber or above, per PR:L) on a site running MB Custom Post Types & Custom Taxonomies before 2.12.2; in practice this means the target site must permit low-privilege/self-service user registration for an unprivileged outsider to exploit it. The vulnerable path is the plugin's migration action, which performs neither a capability check nor nonce validation, so no CSRF token or admin role is needed. Limiting factors: it is a one-way, single-shot migration (once triggered the configuration is already destroyed, so it cannot be repeated for further effect), there is no confidentiality exposure (C:N), and sites with registration disabled are only exposed to existing logged-in users.

This is a lower-tier but genuinely destructive broken-access-control flaw (CWE-862) rather than a high-urgency priority. The signals are internally consistent on the low-risk axis: the vendor CVSS base score is 4.2, EPSS is just 0.14% (3rd percentile) indicating no meaningful mass-exploitation pressure, it is NOT in CISA KEV, and no SSVC decision data was provided. The one aggravating signal is that publicly available exploit code exists (WPScan). However, exploitation is gated by PR:L - the attacker needs a valid authenticated account (e.g., subscriber), which limits opportunistic internet-wide abuse to sites that allow self-registration. Two signals conflict and should be verified: (1) the vendor vector sets AC:H, but the description (no capability check AND no nonce validation on the migration action) implies the trigger is trivial once authenticated, so I assess AC:L - the AC:H rating may reflect the one-way/single-shot nature of the migration rather than true exploit complexity; (2) the vendor rates availability impact A:L, yet the described effect is PERMANENT deletion of the entire post-type and taxonomy configuration, which is a severe, irreversible data-destruction outcome that arguably warrants A:H. Net: not a drop-everything issue by score or EPSS, but the destructive, non-reversible nature means any site permitting low-privilege user registration should patch promptly.

On a WordPress site allowing open registration, an attacker signs up for a free subscriber account, then sends the plugin's migration action request directly (no nonce or capability check blocks it). The one-way migration fires, publishing new records and permanently wiping the site's entire custom post-type and taxonomy configuration - causing irreversible structural data loss. A public proof-of-concept is referenced by WPScan.