Executive brief
ACPT Pro is a WordPress plugin that allows administrators to create and manage custom post types. A PHP object injection vulnerability in versions up to 2.0.63 allows attackers with subscriber-level access to execute arbitrary code on the web server, compromising the entire WordPress site and any data stored within it.
Technical details
The vulnerability is a PHP object injection flaw in the ACPT (Pro) - Custom Post Types plugin for WordPress affecting versions up to 2.0.63. It can be exploited by attackers with subscriber privileges (low-privilege WordPress user accounts) to manipulate object serialization and achieve remote code execution. The attack vector is network-based and requires only subscriber-level access; no authentication bypass is needed since subscribers can already log in. An attacker can leverage unsafe deserialization to instantiate arbitrary PHP objects and invoke methods that lead to command execution on the server. As of the advisory date, no official patch is available from the plugin developers.
Affected products
- ACPT ACPT Pro - Custom Post Types <=2.0.63
Timeline
- 2026-08-24: disclosed
- 2026-06-25: other: Reported to vendor