This vulnerability allows an unauthenticated user to gain elevated privileges within WordPress via the ACPT (Pro) plugin. By exploiting a flaw in the plugin’s access control, an attacker could assign themselves higher role capabilities, effectively bypassing authentication and permission checks. The seriousness of the flaw is reflected in the CVSS score of 9.8, indicating that it is a high‑severity flaw with full scope of impact to confidentiality, integrity, and availability of the site content.

Affected products are ACPT (Pro) – Custom Post Types Plugin for WordPress, versions 2.0.63 and earlier. The plugin is widely used across WordPress installations that have custom post types enabled. Any site that has not applied the latest update is susceptible.

The CVSS score of 9.8 denotes an exploit that can be triggered without authentication, which combined with the lack of a known workaround and the absence of a KEV listing means this flaw could be actively exploited by threat actors. The EPSS score is not available; thus the exact probability cannot be quantified, but given the severity and public disclosure, the risk is high. Attackers would most likely exploit the flaw over the network by sending crafted requests to the plugin’s endpoints, or by logging in as a low‑privileged user and exploiting the plugin’s privilege escalation paths. Because the vulnerability does not require special preconditions beyond the presence of the plugin, the attack vectors are broadly reachable.