EUVD-2026-66991
GHSA-597g-v5f3-3w2v
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network-reachable privilege escalation (PR:N/UI:N) to administrator yields full C/I/A impact; scope unchanged as compromise stays within the WordPress instance.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated Privilege Escalation in ACPT (Pro) - Custom Post Types Plugin for WordPress <= 2.0.63 versions.
Articles & Coverage 1
AnalysisAI
Unauthenticated privilege escalation in the ACPT (Pro) - Custom Post Types plugin for WordPress affects all versions up to and including 2.0.63, allowing remote attackers with no credentials to improperly gain elevated privileges (CWE-266). Rated CVSS 9.8, the flaw grants full confidentiality, integrity, and availability impact, effectively enabling site takeover. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The target must be running the ACPT (Pro) - Custom Post Types Plugin for WordPress at version 2.0.63 or earlier, with the plugin active and its endpoints reachable over the network. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, score 9.8) describes a best-case attacker scenario: network-reachable, low complexity, no privileges, no user interaction, with total impact - signals that consistently point to a genuine high-priority issue rather than an inflated score, because privilege escalation to admin on WordPress typically means full site compromise. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update the ACPT (Pro) - Custom Post Types plugin to the first release above 2.0.63; the input data does not specify an exact fixed version, so confirm the patched build directly from the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/advanced-custom-post-type/vulnerability/wordpress-acpt-pro-custom-post-types-plugin-for-wordpress-plugin-2-0-63-privilege-escalation-vulnerability) or the vendor before deploying. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct an inventory of all WordPress sites running the ACPT (Pro) plugin and immediately disable it on systems where it is not mission-critical; if the plugin is essential, isolate affected WordPress instances to restricted network access and enable web application firewall (WAF) rules blocking unauthorized administrative access attempts. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Remote code execution in the ACPT (Pro) - Custom Post Types Plugin for WordPress (versions through 2.0.47) allows unauth
PHP Object Injection in the ACPT (Pro) - Custom Post Types plugin for WordPress affects all versions up to and including
Subscriber-level SQL injection in ACPT (Pro) Custom Post Types Plugin for WordPress versions 2.0.63 and earlier permits
Same weakness CWE-266 – Incorrect Privilege Assignment
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today