Unauthorized Migration in MB Custom Post Types WordPress Plugin

Executive Summary

This vulnerability affects the MB Custom Post Types & Custom Taxonomies WordPress plugin before version 2.12.2. It allows any authenticated user, including low-privilege subscribers, to trigger a migration action without proper authorization checks or nonce validation. This can create published records and permanently delete all post-type and taxonomy configurations from the plugin.

Useful 0 Not Useful 0

Detection Guidance

Check the installed version of the MB Custom Post Types & Custom Taxonomies plugin. If it is below 2.12.2, the system is vulnerable. Use WordPress admin panel or run a command like 'wp plugin list' in the WordPress directory to verify the version.

Useful 0 Not Useful 0

Impact Analysis

An attacker with subscriber-level access or higher could exploit this to disrupt your WordPress site by deleting custom post types and taxonomies, which may be critical for site functionality. Published records created during exploitation could also introduce unwanted content.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows unauthorized users to create published records and delete configurations, which could lead to unauthorized data modifications or deletions. Such actions may violate data integrity and access control requirements in GDPR and HIPAA, potentially resulting in non-compliance with these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Update the MB Custom Post Types & Custom Taxonomies plugin to version 2.12.2 or later immediately. Restrict subscriber-level access to trusted users only and review user roles for unauthorized changes.

Useful 0 Not Useful 0