This vulnerability (CWE-502) in ACPT (Pro) - Custom Post Types Plugin for WordPress allows unauthenticated remote attackers to perform PHP Object Injection by exploiting unsafe deserialization of untrusted data. The flaw affects all plugin versions up to and including 2.0.63. Successful exploitation can result in complete system compromise, as indicated by the CVSS 3.1 base score of 9.8 with network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. No official patch or remediation guidance is currently documented.

An attacker can remotely execute arbitrary code or manipulate application logic by injecting malicious PHP objects through deserialization. This leads to full compromise of the affected system's confidentiality, integrity, and availability, potentially allowing complete control over the WordPress environment hosting the vulnerable plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider disabling or removing the ACPT (Pro) plugin if possible to mitigate risk. Monitor vendor channels for updates and apply patches promptly once available.