Technical impact
The vulnerability is a PHP Object Injection flaw affecting ACPT (Pro) Custom Post Types Plugin for WordPress versions up to 2.0.63. An attacker who can influence the serialization or deserialization payload sent to the plugin can instantiate arbitrary PHP objects that execute code on the server. This leads to remote code execution, allowing attackers to read, modify or delete data, install backdoors, or use the compromised server for further attacks. The weakness is a classic Object Injection, categorized as CWE-502.
Affected Systems
All WordPress installations running the ACPT (Pro) Custom Post Types Plugin for WordPress version 2.0.63 or earlier are potentially affected. Typical owners include bloggers, e-commerce sites, and small business sites employing this plugin to manage custom post types.
Risk and Exploitability
The CVSS score of 9.8 indicates a critical severity with full remote execution potential and no authentication requirement. The EPSS score is not available, and the vulnerability is not listed in CISA KEV; however, the lack of a public KEV listing does not mitigate the risk. Attackers can exploit the flaw via a crafted HTTP request that triggers PHP object deserialization, indicating a network-based attack vector. As the flaw affects any user who can send a malformed serialized string to the plugin, the likelihood of exploitation will remain high until a patch is applied.
