CVE-2026-25470: WordPress ACPT (Pro) - Custom Post Types plugin for WordPress plugin <= 2.0.47 - Remote Code Execution (RCE) vulnerability

Synopsis

A code injection vulnerability in the ACPT (Pro) - Custom Post Types Plugin for WordPress (versions through 2.0.47) allows an unauthenticated remote attacker to inject and execute arbitrary code on the host server. The vulnerability is reachable over the network with no authentication required and no victim interaction needed, and the CVSS scope is changed, meaning impact extends beyond the vulnerable component itself. Successful exploitation gives the attacker full control over confidentiality, integrity, and availability of the server. HarborGuard tracks this advisory for patch availability and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable service must be reachable over the network; an attacker sends a crafted HTTP request to the exposed WordPress instance to trigger the injection.

• AuthenticationNot required

  No account or credential of any privilege level is needed to reach the vulnerable code path.

• Victim interactionNot required

  Exploitation is fully server-side; no user action such as clicking a link or opening a file is required.

• Attack complexityDetail

  The exploit is reliable and condition-free, with no race conditions, memory layout dependencies, or other environmental factors required.

Blast Radius

• Attacker executes arbitrary server-side code, enabling full remote control of the WordPress host process.
• All data stored in the WordPress database (posts, user credentials, session tokens, private metadata) is readable and exfiltrable.
• Attacker can modify or delete any persisted content, plugin files, theme files, or database records on the server.
• Because the CVSS scope is changed, impact can extend to other services or tenants sharing the same host or container environment, including potential lateral movement.