The MB Custom Post Types & Custom Taxonomies WordPress plugin before version 2.12.2 contains an improper authorization flaw (CWE‑862). The plugin’s migration actions lack a capability check and nonce validation, allowing any authenticated user—including subscribers—to initiate a one‑way migration that permanently deletes the plugin’s entire post‑type and taxonomy configuration while creating published records. This results in loss of data integrity and configuration, and can render related site functionality unusable.

This vulnerability impacts installations of the MB Custom Post Types & Custom Taxonomies plugin with versions earlier than 2.12.2 on any WordPress site. Sites that run the affected plugin and have users with even subscriber‑level access are at risk.

Exploitation requires only that the attacker be logged into the site as a legitimate user; no advanced technical skill is needed. The EPSS score is below 1 % and the CVSS score is 4.2, indicating low severity by numeric rating, yet the lack of authorization control and the potential for permanent configuration loss still represent a significant integrity and availability risk. The vulnerability is not listed in the CISA KEV catalog.