External risk intelligence

WordPress ACPT Pro Plugin PHP Object Injection.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-32563

This vulnerability affects a WordPress plugin, which is typically deployed as part of a public-facing web application. Since the vulnerable component is part of the website's functionality accessible to visitors or subscribers, it is commonly exposed to the internet.

Deserialization

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in a WordPress plugin that allows for the injection of malicious code through user-submitted data, potentially enabling attackers to take control of affected websites. This issue affects a widely used plugin for managing custom post types.

Code injection risks in a popular WordPress plugin.
High severity indicates significant potential for compromise.
Confirm plugin relevance and assess exposure.

Attack Path

How an attacker could exploit the issue

An attacker can trigger this vulnerability by sending a specially crafted request to a WordPress site using the affected plugin. Because the plugin's functionality is exposed over the network and does not require any special privileges to access, an unauthenticated attacker can send malicious data that the plugin will deserialize, leading to arbitrary code execution.

No authentication required for attack.
Triggered by deserializing untrusted data.
Risk of remote code execution.

Live Threat

Current exploitation, exposure, and threat context

A PHP Object Injection vulnerability in a WordPress plugin could allow unauthenticated attackers to inject malicious PHP objects into the application. This could potentially lead to the execution of arbitrary code on the server when specific actions are triggered within the plugin, impacting the integrity and availability of the WordPress site.

Server-side code execution.
Unauthenticated remote code injection.
Compromised website data and availability.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in a WordPress plugin impacts subscriber access and can lead to full system compromise. The first practical step is for the website owner or platform team to confirm the presence and exposure of the affected plugin, identify the business-criticality of the system, and then ascertain the accountable owner to begin remediation planning.

Plugin owner should manage the issue.
Verify plugin presence and internet reachability.
Plan coordinated remediation efforts.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the ACPT Pro plugin used for in WordPress?

ACPT (Pro) - Custom Post Types is a WordPress plugin designed to help site administrators create, manage, and display custom content structures beyond standard blog posts or pages. It provides a user-friendly interface for building complex data layouts and post types directly within the WordPress dashboard, making it a common tool for developers building custom websites or directory-style platforms.

What does PHP Object Injection mean for CVE-2026-32563?

This vulnerability is classified as CWE-502: Deserialization of Untrusted Data. In plain terms, it means the plugin improperly processes incoming data. An attacker can send a specially formatted piece of data that the plugin treats as a legitimate PHP object. Because the plugin does not verify this input, it effectively tricks the application into executing unauthorized commands, potentially granting the attacker control over the server.

How is this vulnerability triggered by an attacker?

An attacker triggers this bug by sending a crafted request containing malicious data to the WordPress site. The vulnerability resides in how the plugin handles this input during deserialization. It is important to note that this process does not require the attacker to have an existing account, special privileges, or even be logged in; the mere reception of the malicious data by the vulnerable plugin code is sufficient to trigger the flaw.

Is my site at risk according to Halo Surface Signal?

Yes, Halo Surface Signal flags this as likely relevant because the plugin functions as part of a public-facing web application. Since WordPress plugins of this type are specifically intended to handle visitor or subscriber interactions, they are inherently exposed to the internet. If your site runs the affected version of ACPT Pro and is accessible online, it falls within the scope of this threat.

What should I do first if I use this plugin?

Begin by confirming whether the ACPT Pro plugin is installed on your WordPress site and check if it is running version 2.0.63 or earlier. Once you identify that the component is present and exposed to the network, prioritize assigning an accountable owner to manage the security update. Follow standard site maintenance procedures to plan and apply the necessary patches as soon as they become available to mitigate the risk of system compromise.

References

patchstack.com/database/wordpress/plugin/advanced-custom-post-type/v…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.