ACPT (Pro) - Custom Post Types Plugin for WordPress <= 2.0.47 - Unauthenticated Remote Code Execution

The impact of this RCE vulnerability is severe. An attacker could leverage it to gain complete control over the WordPress server hosting the vulnerable plugin. This includes the ability to install malware, steal sensitive data (user credentials, database information, customer data), modify website content, and potentially pivot to other systems on the network. The lack of authentication required for exploitation significantly broadens the attack surface, making it accessible to a wide range of attackers, from opportunistic threat actors to sophisticated cybercriminals. Successful exploitation could lead to data breaches, defacement of the website, and disruption of services.

Websites using the Advanced Custom Post Type plugin, particularly those running older, unpatched versions (≤2.0.47), are at significant risk. Shared hosting environments are especially vulnerable as they often have limited control over plugin updates and security configurations. Sites with weak WordPress security practices, such as default user credentials or outdated WordPress core versions, are also at increased risk.

• wordpress / composer / npm:

wp plugin list | grep advanced-custom-post-type

• wordpress / composer / npm:

wp plugin update advanced-custom-post-type --all

• wordpress / composer / npm:

grep -r 'advanced-custom-post-type' /var/log/apache2/access.log | grep -i 'POST'

• generic web:

curl -I https://your-wordpress-site.com/wp-admin/admin-ajax.php?action=advanced_custom_post_type_some_vulnerable_function

1. 2026-03-16Disclosure

   disclosure

1. प्रकाशित2026-03-16
2. संशोधित2026-03-27

The primary mitigation for CVE-2026-25470 is to immediately upgrade the Advanced Custom Post Type plugin to a version patched against this vulnerability. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider temporarily disabling the plugin. Web Application Firewalls (WAFs) configured with rules to detect and block suspicious code execution attempts targeting the plugin's endpoints can provide an additional layer of defense. Monitor WordPress access logs for unusual activity, particularly requests originating from unknown IP addresses or containing suspicious payloads. Review plugin configurations for any unnecessary permissions or exposed functionality.