CVE-2025-12826 is an authorization bypass vulnerability in the Custom Post Type UI WordPress plugin, affecting all versions up to and including 1.18.0. The issue arises because the plugin fails to verify that a user has the required capability before performing actions in the cptui_process_post_type function. This allows authenticated users with subscriber-level privileges or higher to manipulate custom post types by adding, editing, or deleting them in limited scenarios. The vulnerability is categorized under CWE-862 (Missing Authorization). The CVSS v3.1 base score is 4.8, indicating medium severity. No patch or remediation has been documented in the provided data.

An attacker with authenticated access at subscriber level or above can bypass authorization controls to modify custom post types, potentially impacting the integrity and availability of content managed by the plugin. There is no indication of confidentiality impact. The vulnerability could lead to unauthorized content changes but requires authenticated access and has a high attack complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles and capabilities to trusted users only and monitor for unusual activity related to custom post types. Avoid granting subscriber or higher privileges to untrusted users. Follow updates from webdevstudios for any forthcoming patches or official mitigations.