EUVD-2026-65167
GHSA-89vc-p8p8-f8q8
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description scopes this to Subscriber-level access, so PR:L not PR:N; network vector, low complexity, and object injection can yield full CIA impact.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
2DescriptionCVE.org
Subscriber PHP Object Injection in ACPT (Pro) - Custom Post Types Plugin for WordPress <= 2.0.63 versions.
Articles & Coverage 1
AnalysisAI
PHP Object Injection in the ACPT (Pro) - Custom Post Types plugin for WordPress affects all versions up to and including 2.0.63, allowing an attacker to inject a serialized PHP object that the plugin deserializes. The vendor advisory (Patchstack) frames this as a 'Subscriber' level issue, meaning a low-privileged authenticated account can supply crafted serialized data; where a suitable POP gadget chain exists in the plugin or its dependencies, this can escalate to code execution, data theft, or site compromise. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Per the vulnerability title and description, exploitation requires an authenticated account at Subscriber level or higher on the target WordPress site, plus a reachable PHP POP gadget chain to convert object injection into meaningful impact. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H, score 9.8) rates this critical and unauthenticated, but this directly conflicts with the description and Patchstack title, which both scope the flaw to 'Subscriber' level - i.e. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch version is identified in the provided data; the advisory only establishes that versions ≤2.0.63 are affected, so upgrade to the first fixed release once the vendor confirms it (verify via the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/advanced-custom-post-type/vulnerability/wordpress-acpt-pro-custom-post-types-plugin-for-wordpress-plugin-2-0-63-php-object-injection-vulnerability). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: audit all WordPress installations to identify whether ACPT (Pro) plugin version 2.0.63 or earlier is installed, and restrict subscriber account creation or remove existing low-privileged accounts if operationally feasible. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today