The MB Custom Post Types & Custom Taxonomies WordPress plugin contains a flaw that bypasses authentication checks before executing legacy data migrations. When an attacker includes the 'mbcpt-force' parameter in an unauthenticated request, the plugin re‑runs a migration that undoes custom post type or taxonomy definitions back to their pre‑upgrade state. This discards any configuration changes a site administrator made after upgrading and, if visibility restrictions were applied, silently re‑exposes those definitions and their content to anonymous visitors. The weakness stems from an improper authentication check (CWE‑862).

Any WordPress site that installed a version of the plugin earlier than 2.12.3 is potentially affected, as the CVE description indicates that the flaw exists on all pre‑2.12.3 releases. The title mentions 2.0.2 through 2.12.2, but the CVE data does not confirm a lower bound; therefore any earlier version is included. Sites that upgraded from a pre‑2.0 release and rely on the plugin’s migrations for custom definitions are consequently at risk. Because the version range is not explicitly stated, site owners must check the installed plugin version for the presence of the vulnerability.

Based on the description, it is inferred that the attack path requires only an unauthenticated HTTP request with the 'mbcpt-force' parameter. The EPSS score is not available and the issue is not listed in the CISA KEV catalog, indicating no known public exploitation. The CVSS score of 4.8 indicates moderate severity. However, because the flaw bypasses authentication, the attacker does not need privileged access; the vulnerability can be exploited by anyone who can reach the relevant URL. The result is the reversal of custom post type/taxonomy definitions, exposing hidden content.