The flaw is a classic SQL injection in the subscription handling code of the ACPT (Pro) plugin. By submitting crafted subscriber data, an attacker can alter the SQL query that the plugin executes against the database. This can result in unauthorized data read, modification, or other high-impact actions if the database account has elevated privileges. The vulnerability is classified as CWE-89.

Any WordPress installation that has ACPT (Pro) – Custom Post Types Plugin version 2.0.63 or earlier is affected. The vulnerable code paths exist only in those legacy releases of the plugin.

The CVSS score of 8.5 indicates high severity, and although the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, the flaw can be reached via publicly exposed web forms that handle subscriber input, inferred from the subscription context. An attacker who can submit malicious data could exploit the injection. The potential impact includes data compromise, warranting prompt remediation.