What is the CVSS score of CVE-2026-25470?

CVE-2026-25470 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of ACPT Pro are affected by CVE-2026-25470?

The ACPT (Pro) Custom Post Types Plugin for WordPress (versions through 2.0.47) contains a critical remote code execution vulnerability enabling unauthenticated attackers to fully compromise…

How to fix or mitigate CVE-2026-25470?

Within 24 hours: Identify all instances of ACPT (Pro) version 2.0.47 and earlier; immediately disable the plugin if operationally feasible. Within 7 days: If the plugin is business-critical, implement network-level access restrictions to WordPress administrative endpoints and deploy WAF rules to block requests to vulnerable code paths. Within 30 days: Monitor vendor announcements for ACPT (Pro) version 2.0.48 or later; schedule immediate patching upon release.

ACPT Pro CVE-2026-25470

EUVD-2026-37503 CRITICAL

Code Injection (CWE-94)

2026-06-16 Patchstack

WordPress RCE Code Injection Wordpress Plugin Acpt Pro Custom Post Types Plugin For Wordpress Acpt

10.0

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

10.0 CRITICAL

WordPress plugin code-injection reachable over HTTP with no authentication or user interaction; PHP RCE compromises the whole WordPress host beyond the plugin's security authority, justifying S:C and full C/I/A high.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 23:45 vuln.today

CVE Published

Jun 16, 2026 - 21:25 cve.org

CRITICAL 10.0

DescriptionCVE.org

Improper Control of Generation of Code ('Code Injection') vulnerability in ACPT ACPT (Pro) - Custom Post Types Plugin for WordPress allows Remote Code Inclusion.

This issue affects ACPT (Pro) - Custom Post Types Plugin for WordPress: from n/a through 2.0.47.

Articles & Coverage 1

News Critical RCE in WordPress ACPT Pro Custom Post Types Plugin - CVE-2026-25470 Jun 17, 2026

AnalysisAI

Remote code execution in the ACPT (Pro) - Custom Post Types Plugin for WordPress (versions through 2.0.47) allows unauthenticated remote attackers to inject and execute arbitrary code on the underlying WordPress host. The CVSS 3.1 base score of 10.0 with a scope change (S:C) indicates the flaw escapes the plugin sandbox and compromises the entire WordPress installation. No public exploit has been identified at time of analysis, but the trivial attack profile (network, no auth, no UI) makes this a high-priority patching target.

Technical ContextAI

ACPT (Pro) is a commercial WordPress plugin that lets site administrators define and manage custom post types, taxonomies, and meta fields. The root cause is CWE-94 (Improper Control of Generation of Code, 'Code Injection'), meaning attacker-supplied input is incorporated into a code path that is later evaluated or included by PHP - classic vectors include eval(), include/require with attacker-controlled paths, or unsafe template rendering. The CPE cpe:2.3:a:acpt:acpt_(pro)_-_custom_post_types_plugin_for_wordpress:*:*:* confirms all versions of the Pro edition are in scope. Because WordPress plugins execute within the main wp-includes/PHP runtime, successful code injection yields full webserver-level execution rather than isolated plugin behavior.

RemediationAI

Upstream fix availability is not independently confirmed in the supplied data - the Patchstack advisory documents the vulnerability through 2.0.47 but no fixed version is named, so administrators should consult the Patchstack entry (https://patchstack.com/database/wordpress/plugin/advanced-custom-post-type/vulnerability/wordpress-acpt-pro-custom-post-types-plugin-for-wordpress-plugin-2-0-47-remote-code-execution-rce-vulnerability) and the ACPT vendor portal for a release newer than 2.0.47 and upgrade immediately once available. Until a patched version is installed, deactivate and remove the ACPT Pro plugin from production sites, since a CVSS 10.0 unauthenticated RCE in an active plugin cannot be safely left running. If removal is operationally impossible, place the WordPress site behind a WAF (Patchstack, Wordfence, or Cloudflare managed rules) with virtual-patching enabled for this CVE, restrict access to /wp-admin and to any ACPT REST/AJAX endpoints by source IP, and monitor PHP error logs and web-access logs for anomalous POSTs targeting ACPT routes - note that WAF rules are a stopgap and may be bypassed by novel payload encodings.