CVE-2026-32564: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in ACPT ACPT (Pro) - Custom Post Types Plugin for WordPress

This vulnerability, identified as CVE-2026-32564, is an SQL Injection issue (CWE-89) in the ACPT (Pro) - Custom Post Types Plugin for WordPress. It affects versions up to and including 2.0.63. The vulnerability arises from improper neutralization of special elements used in SQL commands, allowing an attacker with low privileges to inject SQL code. The CVSS 3.1 base score is 8.5, indicating high severity, with network attack vector, low attack complexity, low privileges required, no user interaction, scope changed, high impact on confidentiality, no impact on integrity, and low impact on availability. There is no vendor advisory or patch available at this time, and no known exploits in the wild have been reported.

An attacker with low privileges can exploit this SQL Injection vulnerability to execute unauthorized SQL commands, potentially leading to unauthorized disclosure of sensitive data (high confidentiality impact) and limited disruption of service (low availability impact). The integrity of data is not impacted according to the CVSS vector. The scope of the impact is changed, meaning the vulnerability affects resources beyond the initially vulnerable component.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to the plugin's functionality to trusted users only and monitor for unusual database activity. Avoid exposing the affected plugin to untrusted users or inputs. Do not rely on generic mitigations unless specifically recommended by the vendor.