The MB Custom Post Types & Custom Taxonomies WordPress plugin before version 2.12.3 does not perform a capability check in its export feature. A user with a role as low as Contributor can trigger an export that returns the configuration of admin-only custom post types and taxonomies and also provides the titles, dates, statuses and portions of stored content of other users' non-public posts and pages. This allows disclosure of data that should be restricted to higher-privilege accounts. The flaw is an access-control weakness that results in information exposure.

All WordPress sites that have the MB Custom Post Types & Custom Taxonomies plugin installed with a version ranging from 2.4.0 up to 2.12.2 are vulnerable. The issue is tied specifically to the plugin's export functionality and applies wherever the plugin is enabled on a production site.

No EPSS score is available, so the probability of exploitation is unknown. The vulnerability can be exercised by any user who already has a Contributor role, which on many sites may be a common role. It is inferred that the flaw does not provide privilege escalation because it only permits read access and does not alter capabilities. The vulnerability is not listed in CISA's KEV catalog and no public exploits are reported, yet the breadth of possible affected accounts makes the risk primarily driven by data disclosure rather than active exploitation. The CVSS score of 2.7 indicates a low severity level for this attack.