EUVD-2026-108014
GHSA-r9xx-rhcx-ph2x
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privilege Contributor
-
ExploitInvoke plugin export feature
-
ExecutionMissing capability check grants access
-
ImpactRead admin CPT/taxonomy config and others' private post data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated WordPress account holding at least the Contributor role on a site running MB Custom Post Types & Custom Taxonomies from version 2.4.0 up to (but not including) 2.12.3, and use of the plugin's export feature, which omits the capability check. Limiting factors: a valid low-privilege account is needed (so not anonymous/remote-unauthenticated), impact is read-only disclosure of configuration and non-public post metadata/partial content with no write or availability effect, and sites on 2.12.3 or later or not using this plugin are unaffected. |
| Impact | All signals point to a genuinely low-priority issue. The CVSS 3.1 base score is 2.7 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N) with impact limited to a partial confidentiality loss (C:L) and no integrity or availability impact (CWE-863, incorrect authorization). The vuln.today decision label is 'monitor', there is no CISA KEV listing, and no EPSS score was supplied, so exploitation-probability cannot be quantified from the input. Only a WPScan reference is provided as a PoC - not verified working exploit code. One internal inconsistency should be noted: the vendor vector encodes PR:H, yet the description states the flaw is reachable by a user 'with a role as low as Contributor', which is a low-privilege authenticated role - PR:L would be more faithful, and that would raise the base score to ~4.3 rather than lower it, though the issue remains low/medium severity either way. Net assessment: a real but minor authenticated information-disclosure bug, not an urgent patch-now item. |
| Exploit ScenarioDerived | An attacker who already holds (or registers for) a Contributor-level account on a WordPress site running the vulnerable plugin invokes the plugin's export feature, which omits a capability check. They thereby read the configuration of admin-only custom post types and taxonomies plus the titles, dates, statuses and some stored content of other users' non-public posts and pages. A public PoC reference exists (WPScan); it is not verified as working exploit code. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 22, 2026
The MB Custom Post Types & Custom Taxonomies plugin before 2.12.3 allows any authenticated WordPress user with the Contributor role to use its export feature without a capability check, disclosing admin-only custom post type and taxonomy configuration plus titles, dates, statuses and some stored content from other users' non-public posts and pages. Impact is read-only and low severity, and exploitation requires a valid low-privilege account on an affected site. A public PoC reference exists, but it is not verified as working exploit code.
RemediationAI
Upgrade MB Custom Post Types & Custom Taxonomies to 2.12.3 or later; the vendor patch is available and the fixed version is 2.12.3. Advisory details are available at https://nvd.nist.gov/vuln/detail/CVE-2026-110011 and https://wpscan.com/vulnerability/4a9a982d-cbf7-4125-b35c-7dd8af40e745/. No specific workaround is documented in the supplied references; updating is the available complete fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is CWE-863 (Incorrect Authorization) in a WordPress plugin's export functionality: the export path lacks the capability check needed to restrict access to administrative configuration and other users' non-public post/page data. EUVD lists the affected range as MB Custom Post Types & Custom Taxonomies 2.4.0 through versions before 2.12.3, and the supplied CPE is cpe:2.3:a:unknown:mb_custom_post_types_&_custom_taxonomies:*:*:*:*:*:*:*:*. The independent assessment rates the flaw CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, reflecting an authenticated Contributor-level user reading limited data with no integrity or availability effect; the supplied vector's PR:H differs, and the assessed PR:L is the operative characterization here. Exploitation is tied to invoking the plugin's export feature as a low-privileged authenticated user, and that is the only trigger described in the available sources.
Know when Mb Custom Post Types Custom Taxonomies gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Reachable over the network by a low-privilege Contributor account (PR:L, not PR:H, per the description), yielding only partial confidentiality disclosure with no integrity or availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.3 does not perform a capability check in its export feature, allowing users with a role as low as Contributor to read the configuration of admin-only custom post types and taxonomies, as well as the titles, dates, statuses and some stored content of other users' non-public posts and pages.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
The WordPress plugin MB Custom Post Types & Custom Taxonomies (MetaBox) before version 2.12.3 exposes a legacy data-migr
Missing authorization and CSRF protections in the MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.
The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.7.7 does not sanitise and escape some of its sett
Exploit-DB