CVE-2026-32563 A CPT CVE debrief

Who should care

WordPress administrators and users of the ACPT (Pro) - Custom Post Types Plugin, especially those with subscriber-level access, should assess their exposure and take immediate action to update the plugin or apply compensating controls.

Why it matters

CVE-2026-32563 is a critical vulnerability in the ACPT (Pro) - Custom Post Types Plugin for WordPress that could allow attackers to execute arbitrary code on the server. WordPress administrators and users of the affected plugin should assess their exposure and take immediate action to update the plugin or apply compensating controls.

• Potential code execution on the server
• Possible escalation of privileges from subscriber to higher levels
• Potential data breaches or unauthorized access to sensitive information
• Need for immediate patching or mitigation to prevent exploitation

Technical summary

The ACPT (Pro) - Custom Post Types Plugin for WordPress, up to version 2.0.63, is vulnerable to a Subscriber PHP Object Injection. This vulnerability is due to inadequate input validation and sanitization, allowing unauthenticated attackers to inject malicious PHP objects.

Defensive priority

High

Recommended defensive actions

• Update the ACPT (Pro) - Custom Post Types Plugin for WordPress to a version beyond 2.0.63
• Restrict access to the plugin's functionality to trusted users only
• Monitor server logs for suspicious activity related to PHP object injection

Evidence notes

The CVE record and NVD entry provide details about the vulnerability, but additional information from other sources is limited.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.