Description

Unauthenticated Privilege Escalation in ACPT (Pro) - Custom Post Types Plugin for WordPress <= 2.0.63 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-27T10:16:35.933Z",
  "pubdate": "2026-08-27T10:16:35.933Z",
  "executiveSummary": "The ACPT (Pro) - Custom Post Types plugin for WordPress, in versions <= 2.0.63, is susceptible to an unauthenticated privilege escalation vulnerability.\nThis flaw allows remote, unauthenticated attackers to manipulate user account privileges without prior authorization.\nThe vulnerability resides in the improper handling of user registration or profile update processes, which fails to enforce strict access control checks on sensitive user meta or role-assignment parameters.\nBy successfully exploiting this, an attacker can elevate their current low-privileged account or create a new account with administrative privileges, granting them full control over the compromised WordPress instance.\nThe risk implication is critical, as it bypasses the standard authentication and authorization schema, leading to potential site-wide compromise, data exfiltration, and execution of arbitrary administrative functions.\nSuccessful exploitation does not require pre-existing elevated access, making it highly attractive for automated and targeted exploitation efforts against public-facing WordPress installations.",
  "technicalDetails": "The root cause of this vulnerability involves an insecure implementation of input validation and insufficient authorization checks within the plugin's data processing logic, specifically concerning user management functions.\nThe vulnerable component likely lacks proper nonce verification or fails to validate the current user's session integrity before executing backend operations that modify user roles or capabilities. In many instances of this vulnerability class, the plugin provides an API endpoint or a request handler that accepts arbitrary user meta updates without verifying the caller's identity or permissions.\nThe attack flow proceeds as follows: First, an unauthenticated attacker identifies the specific endpoint within the ACPT (Pro) codebase responsible for processing user-related updates. Second, the attacker crafts a malicious HTTP request—typically a POST request—targeting this endpoint. The request includes crafted parameters designed to inject or overwrite user metadata, specifically the 'wp_capabilities' or 'role' fields in the database.\nBecause the plugin fails to implement server-side verification of the request's origin or the initiator's authority, the application processes the request as a legitimate administrative command. Consequently, the database record for the attacker's account (or a newly created account) is updated, promoting the account to the 'administrator' role.\nThis vulnerability is particularly dangerous because the attack vector remains exposed over the network, and the lack of authentication requirements allows for seamless execution via automated scripts. Once the attacker successfully elevates their privileges, they gain access to the WordPress dashboard, where they can install malicious plugins, upload web shells, modify theme files, or perform unauthorized database queries.\nThe impact is total system compromise, as the administrative access bypasses all standard WordPress security controls. This allows for the persistence of the attacker's presence via the injection of backdoored admin accounts or the execution of arbitrary PHP code within the server context. Post-exploitation activities typically involve exfiltrating site data, injecting malicious redirects or content, and leveraging the server as part of a larger botnet or as a pivot point for further network penetration."
}