CVE-2026-32563

CriticalCVSS 9.8

Published: 24/08/2026(UTC)Translated: 25/08/2026(UTC)NVD NIST

Summary

Subscriber PHP Object Injection in ACPT (Pro) - Custom Post Types Plugin for WordPress versions up to 2.0.63.

Risk Assessment

An attacker with subscriber privileges can exploit this to achieve remote code execution or data manipulation, potentially leading to privilege escalation and site takeover.

Recommendation

Update ACPT (Pro) plugin to the latest patched version. Restrict subscriber privileges and monitor user activity.

Original NVD description (English source)

Subscriber PHP Object Injection in ACPT (Pro) - Custom Post Types Plugin for WordPress <= 2.0.63 versions.