External risk intelligence

ACPT Pro Privilege Escalation Vulnerability in WordPress Plugin

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-32566

The vulnerability affects a WordPress plugin. WordPress sites are frequently deployed as public-facing web applications, making components and plugins within them commonly accessible via the public internet.

Privilege Escalation

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical security vulnerability has been identified in a WordPress plugin that allows for custom post types. This issue could enable unauthorized access and control over WordPress sites. While the specific impact depends on whether the affected plugin is in use, its public-facing nature presents a potential risk.

Unauthenticated attackers could gain control.
Affects popular WordPress custom post type plugin.
Confirm if your organization uses this plugin.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker could exploit this vulnerability by targeting the Custom Post Types plugin on a WordPress site. By interacting with a specific feature within the plugin, an attacker could escalate their privileges, potentially gaining administrative control over the website.

No authentication required.
Triggered via plugin feature.
Leads to admin control.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to escalate privileges on a WordPress site using the ACPT (Pro) - Custom Post Types plugin. This could lead to unauthorized administrative access and modification of site content and settings.

Site content and settings are at risk.
Unauthenticated network access could expose the system.
Complete site compromise may occur.

Operational Fix

Recommended remediation, mitigation, and detection steps

Real-world ownership of this unauthenticated privilege escalation vulnerability likely resides with the WordPress site administrators and the platform or application teams managing the WordPress environment. The first practical step is to identify all WordPress instances utilizing the ACPT (Pro) plugin, confirm their accessibility and business criticality, and then engage the accountable owner to plan remediation.

WordPress administrators should own this issue.
Verify ACPT (Pro) plugin usage and reachability.
Plan remediation during the next maintenance window.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the ACPT (Pro) plugin used for in WordPress?

ACPT (Pro) is a plugin that enhances WordPress by allowing users to define and manage custom post types beyond the default blog posts and pages. It essentially provides a structured way to build custom content architectures—such as portfolios, product catalogs, or event directories—directly within the WordPress dashboard, giving site creators more control over how their data is organized and displayed.

How does this CVE-2026-32566 vulnerability work?

This vulnerability is classified as CWE-266: Incorrect Privilege Assignment. In plain terms, the plugin fails to properly verify the identity or permissions of someone interacting with its internal features. Because the security check is missing, an unauthenticated person can perform actions reserved for administrators, allowing them to gain elevated rights and control the application without needing a valid login.

Do I need to be logged into the site for this to be triggered?

No. The vulnerability is triggered by an unauthenticated attacker, meaning no active user session, password, or existing account on the WordPress site is required to initiate the exploit. It is triggered by interacting with specific plugin features over the network. Simply having the plugin active is enough to make the site susceptible to this privilege escalation attempt.

Is my site at risk if it uses this plugin?

Yes, if your site is reachable from the internet, it is at higher risk. According to Halo Surface Signal, this vulnerability affects a WordPress plugin which is often deployed as a public-facing web application. Since the attack vector is network-based and does not require credentials, any instance of the plugin exposed to the public internet is considered a likely candidate for unauthorized access.

What is the first step to address this issue?

Your first step is to perform an inventory of your WordPress installations to confirm if the ACPT (Pro) plugin is currently active. Once you have a list of affected instances, assess their public reachability and importance to your operations. Coordinate with your site administrators to verify these findings and prepare to apply updates or implement protective measures during your next planned maintenance window.

References

patchstack.com/database/wordpress/plugin/advanced-custom-post-type/v…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.