CVE Field Guide
About Us
CVE-2026-32564
PUBLISHED
WordPress ACPT (Pro) - Custom Post Types Plugin for WordPress plugin <= 2.0.63 - SQL Injection vulnerability
Assigner:
Patchstack
Reserved:
12.03.2026
Published:
27.08.2026
Updated:
27.08.2026
Subscriber SQL Injection in ACPT (Pro) - Custom Post Types Plugin for WordPress <= 2.0.63 versions.
Metrics
CVSS 3.1
CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
CVSS Score:
8.5
CVSS score
8.5
Attack Vector
Network
Scope
Changed
Attack Complexity
Low
Confidentiality Impact
High
Privileges Required
Low
Integrity Impact
None
User Interaction
None
Availability Impact
Low
CVSS 3.1
Product Status
Vendor
ACPT
Product
ACPT (Pro) - Custom Post Types Plugin for WordPress
Versions
Default:
unaffected
affected from n/a to 2.0.63 (incl.)
Credits
VDsec | Patchstack Bug Bounty Program
finder
References
https://patchstack.com/database/wordpress/plugin/advanced-custom-post-type/vulnerability/wordpress-acpt-pro-custom-post-types-plugin-for-wordpress-plugin-2-0-63-sql-injection-vulnerability?_s_id=cve
Problem Types
CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CWE
Impacts
CAPEC-7 Blind SQL Injection