{"id":"CVE-2026-110011","title":"MB Custom Post Types & Custom Taxonomies 2.4.0 - 2.12.2 - Contributor+ Post Type Definition and Non-Public Post Metadata Disclosure via Export","summary":"The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.3 does not perform a capability check in its export feature, allowing users with a role as low as Contributor to read the configuration of admin-only custom post t…","severity":"none","cwe":["CWE-863"],"product":"MB Custom Post Types & Custom Taxonomies","affected":["mb_custom_post_types_custom_taxonomies >= 2.4.0 < 2.12.3"],"published":"2026-10-22","updated":"2026-10-22","sourceUpdated":"2026-10-22T06:00:17.779Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-110011","references":[{"url":"https://wpscan.com/vulnerability/4a9a982d-cbf7-4125-b35c-7dd8af40e745/"}],"tags":["cve.org"],"ingestedAt":"2026-10-22T06:30:48.516Z","slug":"CVE-2026-110011","body":"## Overview\n\nThe MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.3 does not perform a capability check in its export feature, allowing users with a role as low as Contributor to read the configuration of admin-only custom post types and taxonomies, as well as the titles, dates, statuses and some stored content of other users' non-public posts and pages.\n\n## Affected\n\n- `mb_custom_post_types_custom_taxonomies >= 2.4.0 < 2.12.3`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}