The ACPT (Premium) plugin for WordPress is vulnerable to remote code execution due to a missing capability check on the REST API endpoint that creates forms and an unsandboxed Twig environment rendering email templates. An authenticated attacker with subscriber-level access can create a form containing malicious email_settings via the REST API. When the form is submitted, the plugin renders these settings with Twig and executes the injected expressions, giving the attacker the ability to run arbitrary code on the server. This flaw allows full compromise of the affected WordPress instance, potentially leaking data, modifying content, and hijacking administrative capabilities.

The vulnerability applies to the ACPT (Premium) plugin developed by Mauro Cassani for WordPress versions 2.0.66 and earlier. Sites that installed any affected version are exposed. The vendor has released a fix in the changelog, so upgrading beyond 2.0.66 removes the risk.

The flaw has a CVSS score of 8.8, indicating a high-severity remote code execution flaw. EPSS data is not available and the vulnerability is not listed in CISA’s KEV catalog, suggesting no widespread exploitation at this time. However, the attack requires only subscription-level privileges, a common role in many sites, and the REST API is accessible over the network. Once authenticated, the attacker can exploit the endpoint with minimal effort, making the risk highly actionable.