Description

Subscriber SQL Injection in ACPT (Pro) - Custom Post Types Plugin for WordPress <= 2.0.63 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.5",
  "pubDate": "2026-08-27T10:16:35.807Z",
  "pubdate": "2026-08-27T10:16:35.807Z",
  "executiveSummary": "A critical SQL injection vulnerability exists in the ACPT (Pro) - Custom Post Types plugin for WordPress, specifically affecting versions 2.0.63 and earlier.\nThis vulnerability allows authenticated users with subscriber-level privileges to execute arbitrary SQL queries against the underlying database.\nThe flaw stems from improper sanitization and parameterization of user-supplied input before it is concatenated into database queries.\nAn attacker can exploit this weakness to exfiltrate sensitive data, modify database records, or potentially gain administrative access to the WordPress environment.\nThe risk is classified as high, as it grants a low-privileged authenticated user the ability to bypass application-level access controls and manipulate the backend database directly.\nExploitation requires active authentication on the target WordPress instance, but does not necessitate additional elevated permissions beyond the standard subscriber role.",
  "technicalDetails": "The vulnerability is a classic SQL injection resulting from insecure handling of input variables within the ACPT (Pro) plugin's backend logic. In versions 2.0.63 and below, the plugin fails to sufficiently sanitize or use prepared statements for specific user-controllable parameters during post type or taxonomy processing.\nThe root cause lies in the application code passing unsanitized input directly into database query functions. Because the plugin does not implement strict type checking or input validation for specific API endpoints or AJAX handlers used by the plugin, a subscriber can inject malicious SQL syntax into fields intended for standard data processing.\nThe attack flow begins with the authenticated user intercepting a request to the vulnerable plugin endpoint. The attacker identifies the injection point—typically a parameter that is echoed back into a WHERE, ORDER BY, or similar SQL clause—and injects SQL fragments. By leveraging UNION-based SQL injection, an attacker can append their own queries to the original request, allowing for the extraction of data from other tables, including the wp_users table.\nBecause WordPress typically runs with the database user having broad permissions, the impact of successful exploitation is significant. An attacker can perform 'blind' SQL injection if the output is not directly returned to the screen, using time-based techniques or boolean-based inference to dump the database schema and content bit by bit.\nFurthermore, since the application does not enforce sufficient nonce verification or capability checks on the vulnerable functions, the entry barrier is minimal for anyone with a registered subscriber account. Once the initial injection is successful, the attacker can leverage the SQL connection to read administrative hashes, insert new administrative users, or disable security plugins, effectively achieving full system compromise through the database layer.\nThe vulnerability is present in the plugin's core architecture where custom post type definitions are processed. Without explicit transition to $wpdb->prepare() or similar parameterization methods, any data flowing through these functions remains susceptible to malicious manipulation."
}