A CPT vulnerabilities and threats

CVE-2026-32566 is a critical vulnerability in the ACPT (Pro) - Custom Post Types Plugin for WordPress, affecting versions up to 2.0.63. It allows unauthenticated users to escalate privileges due to incorrect privilege assignment (CWE-266). The vulnerability has a CVSS score of 9.8, indicating high impact on confidentiality, integrity, and availability. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.

CVE-2026-32564 is a high severity SQL Injection vulnerability in the ACPT (Pro) - Custom Post Types Plugin for WordPress affecting versions up to 2.0.63. The flaw allows an attacker with low privileges to execute unauthorized SQL commands due to improper neutralization of special elements in SQL queries. This vulnerability can lead to a partial compromise of data confidentiality and availability. No official patch or remediation guidance is currently available from the vendor.

CVE-2026-32563 is a critical vulnerability in the ACPT (Pro) - Custom Post Types Plugin for WordPress, affecting versions up to and including 2.0.63. It involves PHP Object Injection due to deserialization of untrusted data (CWE-502). This vulnerability allows remote attackers to execute arbitrary code without authentication, impacting confidentiality, integrity, and availability of affected systems.

Unauthenticated Remote Code Execution (RCE) in ACPT (Pro) - Custom Post Types Plugin for WordPress <= 2.0.47 versions.