MB Custom Post Types EUVD-2026-108013

Exploitation requires that the target site was upgraded to the plugin from a pre-2.0 release, so the legacy data-migration routine and pre-upgrade definition state still exist to be re-run - sites that were never on a pre-2.0 version lack the condition. No authentication is needed (CVSS PR:N) and no user interaction (UI:N). The practical impact is realized only where an administrator, after upgrading, altered a custom post type or taxonomy definition - especially restricting its visibility - since re-running the migration reverts those post-upgrade changes and re-exposes the definition. The AC:H reflects these environmental preconditions (upgrade history plus admin-made restrictive changes) that limit which installations are actually exploitable.

This is a genuine but low-to-moderate priority issue, not a high-CVSS scare. The CVSS base score is 4.8 (Medium) with vector AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N: network-reachable and unauthenticated (PR:N), but with high attack complexity (AC:H) and only limited confidentiality and integrity impact. The AC:H and the description together show the real constraint - exploitation only matters on sites that were upgraded from a pre-2.0 release of the plugin, so the vulnerable legacy migration exists to be re-run; sites never on a pre-2.0 version are not affected in a meaningful way. No CISA KEV listing is present and no EPSS score was supplied, so there is no signal of active or widespread exploitation; the vuln.today Decision label is 'this_month', consistent with a patch-on-normal-cycle item rather than an emergency. A public PoC reference exists (WPScan) but it is not verified as working exploit code, so exploitability in practice is plausible but unconfirmed. The unauthenticated vector (PR:N) is confirmed by the CVSS vector, so the 'Authentication Bypass' framing is directionally correct, though the CWE-862 (Missing Authorization) root cause is more precisely a missing capability/authorization check than a credential bypass. Net: a real authorization defect worth patching this cycle, bounded by the narrow precondition and limited impact.

On a WordPress site whose administrator upgraded this plugin from a pre-2.0 release and then tightened a custom post type or taxonomy to be non-public, an anonymous attacker sends an unauthenticated request to the legacy migration handler. The handler re-runs with no capability check, reverting the definition to its pre-upgrade state, discarding the admin's later changes and silently re-exposing the previously restricted definition and its content to anonymous visitors. A public PoC reference exists (WPScan) but it is not verified as working exploit code.