CVE-2026-32563

Received Received - Intake

Subscriber PHP Object Injection in ACPT Pro WordPress Plugin

Publication date: 2026-08-24

Last updated on: 2026-08-24

Assigner: Patchstack

Description

Subscriber PHP Object Injection in ACPT (Pro) - Custom Post Types Plugin for WordPress <= 2.0.63 versions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-24

Last Modified

2026-08-24

Generated

2026-08-25

AI Q&A

2026-08-25

EPSS Evaluated

N/A

NVD

CVE-2026-32563

Affected Vendors & Products

Vendor	Product	Version / Range
patchstack	custom_post_types_plugin	to 2.0.63 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-502	The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

Executive Summary

This is a PHP Object Injection vulnerability in the ACPT (Pro) - Custom Post Types WordPress plugin affecting versions 2.0.63 and below. It allows unauthenticated attackers to inject malicious PHP objects due to insufficient input sanitization, potentially leading to remote code execution or other attacks.

Impact Analysis

An attacker could exploit this to execute arbitrary code on your server, take control of your WordPress site, steal sensitive data, or disrupt services. Since it requires no authentication, any unpatched site is at high risk.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR (data protection) and HIPAA (health data privacy) requirements. Non-compliance may result in legal penalties, fines, or reputational damage.

Mitigation Strategies

Immediately update the ACPT (Pro) - Custom Post Types Plugin for WordPress to the latest version beyond 2.0.63 to patch the Subscriber PHP Object Injection vulnerability.

Hi! I’m here to help you understand CVE-2026-32563. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70