ACPT Pro Plugin EUVD-2026-66990

Exploitation requires a valid WordPress account with at minimum subscriber-level privileges, as confirmed by CVSS PR:L - unauthenticated exploitation is not supported by the vector. The ACPT (Pro) plugin must be installed and active on the target WordPress instance; the vulnerability surface does not exist without the plugin present. No other non-default configuration appears necessary beyond plugin activation and the attacker holding any authenticated session. What limits exploitation: sites with closed user registration face reduced risk because the attacker must obtain credentials through a separate means such as phishing or credential stuffing; unauthenticated access is ruled out by PR:L. All versions up to and including 2.0.63 are confirmed vulnerable.

The CVSS 8.5 score is well-supported by the vector: network-accessible, low complexity, no user interaction required, with Scope:Changed and high confidentiality impact. The key limiting factor is the PR:L requirement - exploitation requires at minimum a subscriber-level WordPress account, introducing at least one authentication barrier. Sites with open user registration face substantially higher exposure since any self-registered account can trigger the injection path, while closed-registration deployments require the attacker to compromise or phish credentials first. No EPSS data was supplied, preventing probabilistic exploitation comparison. The absence of a CISA KEV listing means active exploitation is unconfirmed; however, the low attack complexity and Patchstack's public disclosure mean the window before weaponization may be short. The Scope:Changed rating amplifies risk beyond typical plugin SQLi by enabling full-database reads, potentially yielding WordPress admin password hashes and site secrets.

An attacker registers a free subscriber account on a WordPress site running ACPT Pro 2.0.63 or earlier, or reuses any compromised low-privilege credential obtained elsewhere. The attacker crafts a malicious HTTP request to an ACPT plugin endpoint, embedding SQL metacharacters in a subscriber-controlled parameter that is passed unsanitized to a database query. The database returns rows from arbitrary WordPress tables - including wp_users - allowing the attacker to harvest password hashes and configuration secrets without triggering elevated-privilege checks. No public exploit code has been identified, but low attack complexity means rapid development is plausible following Patchstack's disclosure.