PT-2025-49007 · WordPress · Custom Post Type Ui

Mahdi Salhi · Published 2025-12-04 · Updated 2025-12-04 · CVE-2025-12826

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions Custom Post Type UI plugin for WordPress versions prior to 1.19.0

Description The Custom Post Type UI plugin for WordPress is susceptible to authorization bypass. The plugin does not properly verify user capabilities when executing the cptui process post type function. This allows authenticated attackers with subscriber-level access or higher to add, edit, or delete custom post types under specific circumstances.

Recommendations Update the Custom Post Type UI plugin to version 1.19.0 or later.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-12826

Affected Products

Custom Post Type Ui

References · 8

• https://osv.dev/vulnerability/CVE-2025-12826 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-12826 · Security Note
• https://github.com/WebDevStudios/custom-post-type-ui/commit/215779a5ac0c624f0dcf875e87305b4898d5bcf9 · Note
• https://t.me/cveNotify/144712 · Telegram Post
• https://t.me/CVEtracker/38807 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1996482614035619984 · Twitter Post
• https://twitter.com/CVEnew/status/1996473228928200803 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/90d203b1-9426-4eff-b566-02c8a1c6adfa?source=cve · Note