PT-2025-48013 · WordPress · Ace Post Type Builder

Abhirup Konwar · Published 2025-11-25 · Updated 2025-11-25 · CVE-2025-13405

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Ace Post Type Builder plugin for WordPress versions prior to 1.9

Description The Ace Post Type Builder plugin for WordPress has an issue where custom taxonomies can be deleted without proper authorization. This is due to a missing authorization check in the cptb delete custom taxonomy() function. Attackers with Subscriber-level access or higher can delete arbitrary custom taxonomies.

Recommendations Update to a version beyond 1.9.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-13405

Affected Products

Ace Post Type Builder

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-13405 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/b56cef33-057b-4c40-945f-68306597b00b?source=cve · Note
• https://twitter.com/VulmonFeeds/status/1993273873618362812 · Twitter Post
• https://plugins.trac.wordpress.org/browser/ace-post-type-builder/trunk/includes/class-cptb-core.php#L400 · Note
• https://plugins.trac.wordpress.org/browser/ace-post-type-builder/tags/1.9/includes/class-cptb-core.php#L400 · Note
• https://plugins.trac.wordpress.org/changeset/3412781 · Note
• https://twitter.com/CVEnew/status/1993225823672041729 · Twitter Post
• https://t.me/CVEtracker/38176 · Telegram Post