ACPT Premium CVE-2026-105701

Requires an authenticated account with subscriber-level capabilities or higher (PR:L), which is a low but real barrier - most impactful on sites that permit open user registration. The site must run ACPT Premium version ≤2.0.66. Exploitation specifically requires reaching the form-creation REST API endpoint (which performs no capability check) to plant a malicious email_settings payload, and then triggering a submission of that form so the unsandboxed Twig environment renders the injected expression. No special non-default plugin configuration is described as necessary, and no victim user interaction is required (UI:N); the limiting factors are the authentication requirement and the presence of the vulnerable plugin version.

This is a genuine high-priority issue rather than a CVSS-inflated paper risk, though not an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8) indicates network-reachable, low-complexity exploitation requiring only low privileges and no user interaction, with full compromise of confidentiality, integrity, and availability. The decisive weakening factor is PR:L: WordPress subscriber-level accounts are frequently self-registerable on sites with open registration, so the 'low privilege' barrier can be near-trivial in practice but is a hard barrier on sites that disable registration. No EPSS score, KEV listing, or POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation - this contrasts with the high theoretical severity and argues against treating it as a drop-everything emergency. The reporter is Wordfence (a credible WordPress-focused source), and the mechanism (unsandboxed Twig template rendering reachable via an unprotected REST endpoint) is a well-understood server-side template injection pattern that typically yields reliable RCE once reached. Net: patch promptly, prioritizing sites that allow open user registration.

An attacker registers (or already holds) a subscriber-level account on a WordPress site running ACPT Premium ≤2.0.66, then calls the form-creation REST API endpoint - which lacks a capability check - to create a form whose email_settings contain a malicious Twig expression. The attacker triggers a submission of that form, causing the unsandboxed Twig environment to evaluate the injected expression and execute arbitrary code on the server. No public POC was provided in the input, but the described multi-step path is concrete and the low attack complexity (AC:L) makes reliable exploitation plausible.