CVE-2026-25470 Overview
CVE-2026-25470 is a code injection vulnerability in the ACPT (Pro) - Custom Post Types Plugin for WordPress. The flaw affects all plugin versions up to and including 2.0.47. Unauthenticated attackers can trigger Remote Code Inclusion against vulnerable WordPress sites over the network. The vulnerability maps to CWE-94: Improper Control of Generation of Code. Patchstack published the advisory tracking this issue under the WordPress plugin vulnerability database.
Critical Impact
Unauthenticated remote attackers can execute arbitrary code on WordPress sites running ACPT (Pro) plugin versions through 2.0.47, leading to full site compromise.
Affected Products
- ACPT (Pro) - Custom Post Types Plugin for WordPress, versions up to and including 2.0.47
- WordPress installations using the affected plugin
- Any WordPress site exposing the plugin endpoints to untrusted networks
Discovery Timeline
- 2026-06-17 - CVE-2026-25470 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2026-25470
Vulnerability Analysis
The ACPT (Pro) plugin improperly controls the generation of code during request handling. An attacker sends a crafted network request that causes the plugin to include or evaluate attacker-controlled code within the WordPress runtime. Because the issue requires no authentication and no user interaction, any reachable installation can be targeted directly.
Successful exploitation grants the attacker the same privileges as the PHP process running WordPress. This typically allows arbitrary file read and write, database access, credential theft, webshell deployment, and lateral movement into adjacent hosting infrastructure. The scope-changed CVSS vector indicates that impact extends beyond the vulnerable component to the broader WordPress environment.
The EPSS score is 0.414% at the 32.965 percentile as of 2026-06-18. No public proof-of-concept or active exploitation has been confirmed at publication time.
Root Cause
The root cause is [CWE-94] Improper Control of Generation of Code. The plugin accepts input that is later interpreted as executable PHP code or included from an attacker-influenced path. Insufficient validation and sanitization on this path allow attacker-supplied content to reach a code generation or file inclusion sink, producing Remote Code Inclusion.
Attack Vector
The attack vector is network-based and requires no privileges or user interaction. An attacker issues HTTP requests to a WordPress site running ACPT (Pro) ≤ 2.0.47. The crafted request manipulates parameters consumed by the vulnerable code path, causing the plugin to include or execute attacker-controlled code in the PHP context. Refer to the Patchstack WordPress RCE Vulnerability advisory for vendor-coordinated technical details.
Detection Methods for CVE-2026-25470
Indicators of Compromise
- Unexpected PHP files appearing under wp-content/plugins/, wp-content/uploads/, or theme directories
- HTTP requests to ACPT plugin endpoints containing URL-encoded PHP keywords, remote URLs, or php:// and data:// wrappers
- New or modified WordPress administrator accounts created without authorization
- Outbound connections from the web server to unfamiliar hosts following inbound requests to plugin URLs
Detection Strategies
- Inspect web server access logs for anomalous POST or GET requests targeting ACPT plugin routes with suspicious parameters
- Monitor the PHP process for unexpected child processes such as sh, bash, curl, wget, or python
- Apply file integrity monitoring to WordPress core, plugin, and theme directories to flag unauthorized writes
- Correlate WordPress audit logs with web server logs to identify privilege escalation following plugin interaction
Monitoring Recommendations
- Enable verbose logging on the web application firewall in front of WordPress and alert on RCE signatures
- Forward web, PHP-FPM, and OS audit logs to a centralized analytics platform for correlation
- Track plugin version inventory across WordPress fleets and alert when ACPT (Pro) ≤ 2.0.47 is observed
How to Mitigate CVE-2026-25470
Immediate Actions Required
- Identify all WordPress instances running ACPT (Pro) and confirm installed versions
- Upgrade ACPT (Pro) to a release later than 2.0.47 as published by the vendor
- Restrict network access to WordPress admin and plugin endpoints from untrusted sources until patched
- Review web server, PHP, and WordPress logs for prior exploitation attempts dating back to plugin install
Patch Information
Upgrade ACPT (Pro) - Custom Post Types Plugin for WordPress to a version released after 2.0.47. Consult the Patchstack advisory for the fixed version reference and vendor guidance.
Workarounds
- Disable and remove the ACPT (Pro) plugin if a patched version cannot be applied immediately
- Deploy WAF rules that block requests containing PHP wrappers, remote URLs, or code keywords against plugin endpoints
- Enforce IP allowlisting on /wp-admin and plugin-specific routes to limit reachable attack surface
- Run PHP with allow_url_include=0 and allow_url_fopen=0 to reduce Remote File Inclusion impact
# Example php.ini hardening to reduce RFI exposure
allow_url_include = 0
allow_url_fopen = 0
disable_functions = exec,passthru,shell_exec,system,proc_open,popen
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
