ACPT Pro EUVD-2026-66991

The target must be running the ACPT (Pro) - Custom Post Types Plugin for WordPress at version 2.0.63 or earlier, with the plugin active and its endpoints reachable over the network. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication and no user interaction are required - this is unauthenticated remote exploitation against affected installations. The primary limiting factor is deployment scope: only sites with this specific commercial plugin installed and activated are exposed; WordPress core and sites using other custom-post-type plugins are not affected. The exact vulnerable endpoint/feature is not detailed in the provided data and should be confirmed from the Patchstack advisory.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, score 9.8) describes a best-case attacker scenario: network-reachable, low complexity, no privileges, no user interaction, with total impact - signals that consistently point to a genuine high-priority issue rather than an inflated score, because privilege escalation to admin on WordPress typically means full site compromise. No EPSS score, SSVC decision, or POC indicator was provided in the input, and the CVE is not present in CISA KEV, so there is currently no evidence of active or automatable exploitation to corroborate the theoretical severity. That said, WordPress plugin authorization flaws are historically attractive to opportunistic mass-scanning, so any operator running this plugin - from a large hosting fleet down to a small municipal IT team - should treat patching as urgent despite the absence of confirmed exploitation. The main data gap is the missing exact fixed version and any exploitation-probability metric; these should be confirmed against the Patchstack advisory before final prioritization.

A remote attacker enumerates WordPress sites running ACPT Pro <= 2.0.63 and sends a crafted unauthenticated request to a vulnerable plugin endpoint that fails to enforce role/capability checks, causing the application to grant the attacker administrator-level privileges. From there the attacker installs a malicious plugin or theme to obtain persistent code execution and full site control. No public exploit code was identified in the provided data, but the low-complexity, no-authentication vector makes weaponization straightforward if endpoint details become known.