The plugin fails to verify user capabilities in the cptui_process_post_type function, allowing any authenticated user with subscriber level or higher to add, edit, or delete custom post types. This authorization bypass can alter the site’s custom post type definitions without proper privilege checks.

WordPress sites running the Custom Post Type UI plugin from WebDevStudios, in any release up to and including version 1.18.0, are affected.

The CVSS score is 4.8, indicating moderate severity. The EPSS is less than 1%, reflecting a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. An attacker must be authenticated with at least subscriber-level access, and the flaw is exercised when the plugin’s CPT management screens are accessed. No publicly disclosed exploit is mentioned in the provided data.