CVE-2026-32566 in Advanced Custom Post Type Plugin
Summary
by MITRE • 08/27/2026
Unauthenticated Privilege Escalation in ACPT (Pro) - Custom Post Types Plugin for WordPress <= 2.0.63 versions.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/27/2026
The vulnerability identified as an unauthenticated privilege escalation within the ACPT Pro plugin, specifically affecting versions up to and including 2.0.63 of this popular WordPress extension for managing custom post types, represents a critical security flaw that undermines the fundamental access control mechanisms of the targeted content management system. This issue arises from insufficient validation and authorization checks in specific administrative endpoints exposed by the plugin, allowing any user with internet access, without requiring valid credentials or login sessions, to manipulate server-side state changes intended for authorized administrators only. The core technical deficiency lies in the failure to verify that the initiating request originates from a session possessing elevated privileges, thereby bypassing standard WordPress capability checks such as current_user_can and nonce verification mechanisms designed to prevent cross-site request forgery and unauthorized actions.
From a technical perspective, this flaw typically manifests through REST API endpoints or AJAX handlers registered by the plugin where input parameters are accepted directly without rigorous sanitization or permission validation. An attacker can craft specific HTTP requests containing manipulated data structures that trigger internal functions responsible for modifying post type configurations, user roles, or system settings. Because these operations often involve writing to the database and altering site configuration, the lack of authentication means that any remote actor on the public internet can execute administrative commands as if they were a super administrator. This effectively grants full control over the WordPress installation, including the ability to create new admin users, modify existing user permissions, inject malicious code into theme files or plugins via stored XSS vectors often facilitated by such privilege escalation, and potentially achieve remote code execution depending on how the manipulated data is subsequently processed by other components of the application stack.
The operational impact of this vulnerability is severe, as it allows for complete compromise of the affected WordPress environment without any prior interaction with legitimate users. Attackers can use this entry point to install backdoors, deface websites, steal sensitive data stored within custom post types or associated metadata, and pivot into internal networks if the web server has broader access rights. Furthermore, because ACPT Pro is widely used for building complex content structures, the ability to alter these definitions remotely can disrupt business logic dependent on specific field configurations or taxonomies. The absence of authentication requirements significantly lowers the barrier to entry for automated scanning tools and opportunistic attackers, making this vulnerability highly susceptible to widespread exploitation in the wild shortly after public disclosure.
This incident aligns with CWE-269, which classifies Improper Privilege Assignment, specifically where a user is granted privileges that exceed their intended role or level of access without proper verification. It also maps closely to MITRE ATT&CK technique T1078, Valid Accounts, as the attacker effectively impersonates an administrative entity by exploiting the system's trust in unverified requests, and potentially T1136, Create Account, if the exploitation involves creating new administrator users for persistent access. The failure to enforce authentication on sensitive endpoints is a classic example of broken object level authorization or missing function level access control, highlighting critical gaps in secure coding practices regarding input validation and session management.
To mitigate this risk immediately, administrators must upgrade ACPT Pro to version 2.0.64 or later where the vendor has implemented strict capability checks on all affected endpoints. Until an update is applied, it is advisable to restrict access to the WordPress admin area using IP whitelisting via firewall rules or web application firewalls that can detect and block suspicious patterns associated with privilege escalation attempts. Additionally, implementing robust security headers and ensuring that no sensitive administrative functionality is exposed through publicly accessible URLs without proper nonce verification will help reduce the attack surface. Regular auditing of plugin code for similar authorization flaws and keeping all WordPress core components and third-party extensions updated to their latest secure versions are essential practices for maintaining a resilient web infrastructure against such exploitation vectors.