{"id":"CVE-2026-109982","title":"MB Custom Post Types & Custom Taxonomies < 2.12.2 - Subscriber+ Missing Authorization via CPT UI Migration","summary":"The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.2 does not perform a capability check or validate a nonce on its migration actions, allowing any authenticated user, such as a subscriber, to trigger a one-way mig…","severity":"medium","cvss":4.2,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L","cvssSource":"adp","cwe":["CWE-862"],"product":"MB Custom Post Types & Custom Taxonomies","affected":["mb_custom_post_types_custom_taxonomies < 2.12.2"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-16T14:38:53.458124Z"},"published":"2026-10-16","updated":"2026-10-16","sourceUpdated":"2026-10-16T14:49:21.095Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-109982","references":[{"url":"https://wpscan.com/vulnerability/27787d4e-1633-4eb6-bcf4-0a8586df3d47/"}],"tags":["cve.org"],"epss":0.00142,"epssPercentile":0.03107,"ingestedAt":"2026-10-16T07:01:11.488Z","slug":"CVE-2026-109982","body":"## Overview\n\nThe MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.2 does not perform a capability check or validate a nonce on its migration actions, allowing any authenticated user, such as a subscriber, to trigger a one-way migration that creates published records and permanently deletes a companion MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.2's entire post-type and taxonomy configuration.\n\n## Affected\n\n- `mb_custom_post_types_custom_taxonomies < 2.12.2`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":23,"depthScoreParts":{"impact":23.1,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":223035,"id":"CVE-2026-109982","ts":1792164076678,"field":"cvss","old":null,"new":"4.2"},{"seq":223034,"id":"CVE-2026-109982","ts":1792164076678,"field":"severity","old":"none","new":"medium"}]}