CVE-2026-32566: Unauthenticated Privilege Escalation in ACPT (Pro) Custom Post Types Plugin

Overview

A critical unauthenticated privilege escalation vulnerability has been disclosed in ACPT (Pro) — Custom Post Types Plugin for WordPress, tracked as CVE-2026-32566 with a CVSS score of 9.8. The flaw lets a low-privileged (or entirely unauthenticated, per NVD's vector) attacker escalate to a higher-privileged account, up to full administrative control of the site.

The issue was reported to the vendor on 2026-06-25 and publicly disclosed by Patchstack on 2026-08-25, credited to researcher VDsec. As of this writing, no official patch has been released — Patchstack has issued a virtual-patching mitigation rule for its customers in the interim.

Technical Details

How It Works

ACPT (Advanced Custom Post Types Toolkit) exposes functionality for managing custom post types, fields, and taxonomies through the WordPress admin. The plugin's privilege-assignment logic fails to correctly verify that a requesting account holds the authority it claims, allowing a malicious actor to assign themselves — or an account they control — elevated capabilities without ever needing valid administrative credentials.

The full-impact CVSS vector (C:H/I:H/A:H with no privileges or interaction required) means a successful attacker can read, modify, and disrupt the entire site once the escalation path is exploited, consistent with gaining administrator-level access to WordPress.

Impact

• Full site takeover — attackers escalating to administrator can install malicious plugins/themes, create backdoor accounts, and modify site content
• No authentication barrier — the attack requires no valid credentials, putting every public-facing install of the plugin at risk
• No official fix yet — sites running ACPT (Pro) ≤ 2.0.63 remain exposed until the vendor ships a patch

Remediation

• No official patch is currently available. Monitor the vendor's changelog and update the moment a fixed version ships
• Disable or remove ACPT (Pro) on production sites until a patch is released if the plugin's functionality is not business-critical
• Patchstack customers can rely on the published mitigation rule as a temporary compensating control
• Restrict admin-ajax and REST API access to the plugin's endpoints via a WAF where feasible
• Review user accounts for unexpected new administrators or role changes as a precaution

References

• NVD — CVE-2026-32566
• Patchstack — ACPT (Pro) Custom Post Types Plugin ≤ 2.0.63 Privilege Escalation