Security Alert Summary
An unauthenticated privilege escalation vulnerability has been reported in the ACPT (Pro) – Custom Post Types Plugin for WordPress affecting versions up to and including 2.0.63. An attacker with network access may be able to escalate privileges without authentication, impacting confidentiality, integrity, and availability.
CVE Details
- CVE ID: CVE-2026-32566
- Affected component: ACPT (Pro) – Custom Post Types Plugin for WordPress
- Affected versions: Versions less than or equal to 2.0.63
- Published: August 27, 2026 at 10:16:35 AM (as provided)
- Last modified: August 27, 2026 at 10:16:35 AM (as provided)
- CVSS v3.1: Base Score 9.8, Severity CRITICAL
- CVSS vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Authentication required: None (unauthenticated)
- Privileges required: None
- User interaction: None
- Primary impacts: Confidentiality: High; Integrity: High; Availability: High
- CWE / weakness: CWE-266 (Incorrect Privilege Management)
Technical Details
The reported issue is an unauthenticated privilege escalation in the ACPT (Pro) – Custom Post Types Plugin for WordPress, affecting plugin versions up to and including 2.0.63. As described, the vulnerability permits an attacker without any authentication to obtain elevated privileges within the WordPress site.
The root cause, as indicated by the description and CWE classification, is incorrect privilege management: the plugin does not enforce required authentication or authorization checks for certain operations, allowing an attacker to perform actions that should be restricted to authenticated users or privileged roles. No specific functions or REST endpoints are named in the provided data.
Impact is consistent with the CVSS metrics: successful exploitation can lead to full exposure of sensitive data, unauthorized modification of content or settings, and disruption of site availability. The description and metrics do not provide exploit code or confirmed in-the-wild activity.
How This Could Impact Your Website
Consider a site with multiple user roles: a site owner, internal staff editors, and an external contractor who contributes content. Because this vulnerability allows privilege escalation without authentication, an unauthenticated attacker could potentially gain privileged capabilities that are normally reserved for authenticated editors or administrators. Practical consequences include exposure of internal user data such as email addresses, unauthorized changes to content or custom post types, and disruption of site functionality.
For example, an attacker could enumerate and access functionality intended only for privileged users, leading to targeted phishing of internal staff or contractors if email addresses are exposed. Site owners and administrators could find configurations changed or content altered by an attacker operating without prior access.
If you9re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor-level accounts and other nonessential privileges.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site.
- Monitor site activity and logs for unusual behavior, including unexpected user role changes or content edits.
If you9d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
