CVE-2026-105701 in ACPT Plugin
Summary
by MITRE • 10/06/2026
The ACPT (Premium) plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.0.66 via the render function. This is due to missing capability check on the REST API form creation endpoint and unsandboxed Twig environment rendering email templates. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute code on the server. The exploit requires the attacker to first create a form with malicious email_settings via the REST API endpoint, then trigger form submission to execute the injected Twig expressions.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/06/2026
The ACPT Premium plugin for WordPress contains a critical Remote Code Execution vulnerability affecting all versions up to and including 2.0.66. This flaw stems from two distinct but compounding technical failures within the plugin's architecture: an insufficient authorization check on the REST API endpoint responsible for form creation, and the use of an unsandboxed Twig template engine when rendering email templates associated with those forms. The combination of these weaknesses allows authenticated attackers to achieve arbitrary code execution on the underlying server infrastructure.
The primary vector for exploitation involves the REST API endpoint used for creating new forms within the plugin. This endpoint fails to enforce proper capability checks, meaning that users with low-privilege accounts, such as subscribers or contributors, can interact with it without restriction. In a secure implementation, only administrators or users with specific form-management privileges should be able to define form structures and their associated behaviors. By bypassing this authorization layer, an attacker gains the ability to inject malicious configuration data into the system through legitimate API calls.
Once access is granted via the vulnerable endpoint, the attacker can manipulate the email_settings parameter of a newly created or existing form. This field dictates how notification emails are generated when a user submits the form. The plugin utilizes Twig as its templating engine for these notifications but configures it in an unsandboxed mode. An unsandboxed environment allows template authors to execute arbitrary PHP code within the context of the WordPress application, rather than being restricted to safe variable output and basic logic operations. This configuration choice significantly expands the attack surface beyond simple data injection into a remote code execution scenario.
The exploitation process requires two distinct steps performed by the attacker. First, they must use the vulnerable REST API endpoint to create or modify a form, embedding malicious Twig expressions within the email_settings payload. These expressions are designed to execute specific PHP commands upon rendering. Second, the attacker triggers the submission of this configured form. When the system processes the submission and attempts to generate the notification email, it parses the injected Twig code. Because the environment is unsandboxed, the Twig engine executes the embedded PHP code with the privileges of the web server process, typically resulting in full control over the compromised WordPress installation.
The operational impact of this vulnerability is severe, as Remote Code Execution represents one of the most critical threat categories in web application security. An attacker who successfully exploits this flaw can install backdoors, exfiltrate sensitive database contents, modify site files to maintain persistence, or pivot further into the internal network depending on the server's configuration and isolation level. The fact that subscriber-level access is sufficient for exploitation means that even users with minimal intended privileges can compromise the entire system, violating the principle of least privilege and undermining the integrity of multi-user WordPress environments.
From a classification perspective, this vulnerability aligns with CWE-269 Improper Privilege Management due to the missing capability check on the REST API endpoint. Additionally, it falls under CWE-78 OS Command Injection or CWE-94 Code Injection because unsandboxed Twig rendering allows for arbitrary code execution. In terms of adversary tactics, this exploit maps directly to ATT&CK technique T1059 Command and Scripting Interpreter, specifically leveraging PHP scripts, as well as T1136 Create Account if the attacker creates new administrative accounts post-exploitation.
Mitigation strategies must address both the authorization gap and the template engine configuration immediately. The most effective remediation is to upgrade the ACPT Premium plugin to a version where these issues have been patched by the vendor, ensuring that proper capability checks are enforced on all REST API endpoints and that Twig templates are rendered in a secure, sandboxed mode if possible. For organizations unable to patch immediately due to compatibility constraints or other operational factors, temporary mitigations should include restricting access to the WordPress admin area via IP whitelisting for administrative users only, implementing Web Application Firewall rules to block suspicious patterns in REST API requests involving Twig syntax such as curly braces with PHP functions, and disabling unnecessary user registration if subscriber-level accounts are not required. Regular auditing of installed plugins and their configurations against known vulnerability databases is also essential to maintain a secure posture.