CVE-2025-13405: Ace Post Type Builder Auth Bypass Flaw

CVE-2025-13405 Overview

CVE-2025-13405 affects the Ace Post Type Builder plugin for WordPress in all versions up to and including 1.9. The cptb_delete_custom_taxonomy() function lacks authorization validation, allowing authenticated users with Subscriber-level access or higher to delete arbitrary custom taxonomies. The vulnerability is categorized as Missing Authorization [CWE-862] and is exploitable over the network without user interaction. Attackers can disrupt site content organization by removing taxonomies that categorize posts, pages, and custom post types.

Critical Impact
Any authenticated user, including low-privilege Subscribers, can delete custom taxonomies across the affected WordPress site, causing content organization loss and potential business disruption.

Affected Products

Ace Post Type Builder plugin for WordPress, all versions through 1.9
WordPress sites allowing Subscriber-level or higher registration
Sites using custom taxonomies managed by this plugin

Discovery Timeline

2025-11-25 - CVE-2025-13405 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-13405

Vulnerability Analysis

The vulnerability resides in the cptb_delete_custom_taxonomy() function within includes/class-cptb-core.php at line 400 of the Ace Post Type Builder plugin. The function processes taxonomy deletion requests without verifying whether the requesting user has appropriate capabilities. WordPress convention requires administrative functions to call current_user_can() with an appropriate capability such as manage_options or edit_posts before performing state-changing operations.

The missing check means any authenticated request reaching this handler executes the deletion logic. Subscriber accounts, which are typically granted through open user registration, gain the same taxonomy deletion capability as administrators. This breaks the WordPress role-based access control model and violates the principle of least privilege.

The EPSS score for this vulnerability sits at 0.234%, indicating a low but non-zero probability of exploitation activity in the near term.

Root Cause

The root cause is the absence of a capability check and nonce verification within cptb_delete_custom_taxonomy(). WordPress plugins must validate both the user's role permissions and the request authenticity to prevent unauthorized state changes. This handler performs neither validation before invoking taxonomy removal.

Attack Vector

An attacker registers a Subscriber account on a target WordPress site or uses any existing low-privilege account. The attacker then sends a crafted request to the plugin's AJAX or admin endpoint targeting cptb_delete_custom_taxonomy() with the taxonomy name to delete. The server processes the request and removes the specified custom taxonomy without validating the caller's authority.

The vulnerability mechanism is described in the Wordfence Vulnerability Report and the affected code is visible in the WordPress Plugin File Reference.

Detection Methods for CVE-2025-13405

Indicators of Compromise

Unexpected disappearance of custom taxonomies configured through Ace Post Type Builder
Content items unexpectedly missing taxonomy term assignments
POST requests to admin-ajax.php referencing the cptb_delete_custom_taxonomy action from non-administrator user sessions
WordPress audit log entries showing taxonomy deletion events originating from Subscriber or Contributor accounts

Detection Strategies

Review WordPress access logs for requests to admin-ajax.php invoking the plugin's delete taxonomy action, and correlate with the requesting user role
Enable a security or audit logging plugin to capture taxonomy schema changes with associated user context
Compare the current list of registered taxonomies against a known-good baseline exported before applying updates
Query the WordPress database for wp_term_taxonomy inconsistencies indicating recently removed taxonomies

Monitoring Recommendations

Alert on any taxonomy deletion event executed by a user without the manage_options capability
Monitor new Subscriber-level account registrations followed by immediate AJAX requests to plugin endpoints
Track outbound modifications to the plugin's custom post type and taxonomy definitions

How to Mitigate CVE-2025-13405

Immediate Actions Required

Update the Ace Post Type Builder plugin to a version released after 1.9 that includes the fix from WordPress Change Set #3412781
Deactivate and remove the plugin if a patched release is not yet available and custom taxonomies are business-critical
Audit WordPress user accounts and remove unused Subscriber-level accounts
Back up the WordPress database and site files before applying updates or workarounds

Patch Information

The vendor addressed the issue in the commit tracked as WordPress Change Set #3412781. Administrators should install the version released above 1.9 through the WordPress plugin management interface. Verify successful patching by confirming the new version number under Plugins > Installed Plugins.

Workarounds

Disable open user registration under Settings > General by unchecking Anyone can register to reduce the attacker pool
Restrict access to admin-ajax.php from unauthenticated and low-privilege sessions using a web application firewall rule targeting the cptb_delete_custom_taxonomy action
Apply a temporary must-use plugin that wraps the vulnerable function with a current_user_can( 'manage_options' ) check until the official patch is applied

bash

# Example WAF rule to block the vulnerable action from non-admin sessions
# ModSecurity example:
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
  "chain,deny,status:403,id:1013405,msg:'Block CVE-2025-13405 taxonomy delete'"
  SecRule ARGS:action "@streq cptb_delete_custom_taxonomy"