CVE-2026-110011

LowCVSS 2.7/10Last modified Oct 22, 2026

Description

The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.3 does not perform a capability check in its export feature, allowing users with a role as low as Contributor to read the configuration of admin-only custom post types and taxonomies, as well as the titles, dates, statuses and some stored content of other users' non-public posts and pages.

Metrics

CVSS 3.1 2.7/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-863

Affected software

No affected versions have been published.

Timeline

Published
Oct 22, 2026
Last modified
Oct 22, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1100124.3The Salon Booking System WordPress plugin before 10.31.3 does not restrict several of its booking REST API routes to users with the approprCVE-2026-1100134.8The Salon Booking System WordPress plugin before 10.31.9 does not generate its booking-API access tokens from a secure random source, insteCVE-2026-1100145.3The Salon Booking System WordPress plugin before 10.31.9 does not properly check authorization before creating a booking and trusts a calleCVE-2026-1100158.8The Salon Booking System WordPress plugin before 10.31.9 does not correctly verify the authenticity of REST API requests and discards WordPCVE-2026-1100176.4The Quick PayPal Payments: Payment Button & Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form' parameter CVE-2026-1100188.8The aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder plugin for WordPress is vulnerable tCVE-2026-1100194.3The Bulk Page Generator – LPagery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.1.0 ThiCVE-2026-110029.6Use after free in Autofill in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potCVE-2026-1100246.8@fastify/jwt is a JWT utility plugin for Fastify. In versions prior to 10.2.5, the top-level sign and verify methods replace the globally coCVE-2026-1100257.3A flaw has been found in slackero phpwcms up to 1.9.49/1.12.3. This issue affects some unknown processing of the file include/inc_front/contCVE-2026-1100264.9The Tasty Recipes Lite WordPress plugin before 1.2.11 does not correctly check user capabilities when creating, renaming and deleting taxonCVE-2026-1100295.4The Squeeze WordPress plugin before 1.8.1 does not perform a capability check on one of its AJAX actions, allowing authenticated users with