CVE-2026-32563

CriticalCVSS 9.8

Published: 24/08/2026(UTC)Updated: 26/08/2026(UTC)Translated: 25/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.43%

35th percentile - higher than 35% of all known CVEs

Summary

Subscriber PHP Object Injection in ACPT (Pro) - Custom Post Types Plugin for WordPress versions up to 2.0.63.

Risk Assessment

An attacker with subscriber privileges can exploit this to achieve remote code execution or data manipulation, potentially leading to privilege escalation and site takeover.

Recommendation

Update ACPT (Pro) plugin to the latest patched version. Restrict subscriber privileges and monitor user activity.

Other vulnerabilities in ACPT (Pro)

CVE-2026-32566Critical
The ACPT (Pro) - Custom Post Types Plugin for WordPress versions up to 2.0.63 contain an unauthenticated privilege escalation vulnerability. An attacker can gain higher privileges in the system.

Original NVD description (English source)

Subscriber PHP Object Injection in ACPT (Pro) - Custom Post Types Plugin for WordPress <= 2.0.63 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS