PT-2026-50086 · WordPress · Acpt

Jarno Vos + 1 · CVE-2026-25470 · Published 2026-06-16 · Updated 2026-06-18

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ACPT (Pro) - Custom Post Types Plugin for WordPress versions prior to 2.0.48

Description Improper Control of Generation of Code allows for Remote Code Inclusion and unauthenticated Remote Code Execution (RCE). This issue enables an attacker to inject malicious code into the system without requiring authentication.

Recommendations Update the plugin to a version later than 2.0.47.

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2026-25470

Affected Products

Acpt

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-25470 · Security Note
• https://patchstack.com/database/wordpress/plugin/advanced-custom-post-type/vulnerability/wordpress-acpt-pro-custom-post-types-plugin-for-wordpress-plugin-2-0-47-remote-code-execution-rce-vulnerability?_s_id=cve · Note
• https://twitter.com/SecAlertsCo/status/2067723426177962420 · Twitter Post
• https://t.me/CVEtracker/57042 · Telegram Post