CVE-2026-32563: ACPT WordPress Plugin Object Injection Flaw

CVE-2026-32563 Overview

CVE-2026-32563 is a PHP Object Injection vulnerability in the ACPT (Pro) - Custom Post Types Plugin for WordPress, affecting versions up to and including 2.0.63. The flaw allows authenticated users with Subscriber-level access to inject arbitrary PHP objects through untrusted deserialization operations. Successful exploitation can lead to remote code execution, data tampering, and full compromise of the underlying WordPress site. The issue is tracked under CWE-502: Deserialization of Untrusted Data and was published to the National Vulnerability Database (NVD) on August 24, 2026.

Critical Impact
A low-privileged Subscriber account can trigger unsafe object deserialization, enabling remote code execution and complete site takeover on unpatched installations.

Affected Products

ACPT (Pro) - Custom Post Types Plugin for WordPress, versions <= 2.0.63
WordPress installations running the vulnerable plugin with public registration or Subscriber accounts enabled
Sites integrating ACPT Pro with additional plugins containing exploitable PHP gadget chains

Discovery Timeline

2026-08-24 - CVE-2026-32563 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-32563

Vulnerability Analysis

The vulnerability arises from unsafe deserialization of user-supplied input within the ACPT (Pro) plugin. The plugin passes attacker-controlled data to PHP's unserialize() function without validating structure or origin. Because authentication requirements stop at the Subscriber role, exploitation is available to any registered user on affected sites.

PHP Object Injection allows attackers to instantiate arbitrary classes present in the WordPress runtime. When these classes implement magic methods such as __wakeup(), __destruct(), or __toString(), the deserialized object can trigger unintended code paths. Attackers commonly chain these gadgets to reach file writes, database operations, or command execution.

The impact spans confidentiality, integrity, and availability. Post-exploitation activity typically includes webshell placement, administrator account creation, and lateral pivoting into the hosting environment. The Exploit Prediction Scoring System (EPSS) reports a probability of 0.426% as of August 27, 2026.

Root Cause

The root cause is deserialization of untrusted data ([CWE-502]). The plugin accepts serialized payloads from Subscriber-authenticated request handlers and passes them directly to unserialize(). No allowlist of permitted classes is enforced, and no HMAC or signature validates the payload before processing.

Attack Vector

The attack vector is network-based and does not require user interaction. An attacker registers or authenticates as a Subscriber, then submits a crafted serialized PHP payload to a vulnerable plugin endpoint. The payload leverages a gadget chain present in WordPress core or installed plugins to execute arbitrary code. Refer to the Patchstack advisory for technical details.

Detection Methods for CVE-2026-32563

Indicators of Compromise

HTTP request bodies or query parameters containing serialized PHP markers such as O:, a:, or s: sent to ACPT plugin endpoints
Unexpected PHP files written under wp-content/uploads/ or plugin directories following Subscriber-authenticated requests
New administrator accounts or modified user roles created shortly after Subscriber logins
Outbound connections from the web server to attacker-controlled hosts originating from PHP worker processes

Detection Strategies

Inspect web server access logs for POST requests to ACPT plugin routes carrying serialized object patterns
Enable WordPress audit logging and correlate Subscriber authentication events with plugin API calls
Deploy a Web Application Firewall (WAF) rule set that flags PHP serialization primitives in request parameters
Monitor file integrity on the wp-content directory and alert on new or modified PHP files

Monitoring Recommendations

Forward WordPress, PHP-FPM, and web server logs to a centralized SIEM for correlation across authentication and file-write events
Alert on PHP processes spawning shell binaries such as sh, bash, or curl
Track anomalous privilege changes within the wp_users and wp_usermeta tables

How to Mitigate CVE-2026-32563

Immediate Actions Required

Upgrade the ACPT (Pro) - Custom Post Types Plugin to a version later than 2.0.63 as soon as the vendor releases a patched build
Disable open user registration if Subscriber accounts are not operationally required
Audit existing Subscriber accounts for suspicious activity, unexpected creation dates, or elevated permissions
Rotate WordPress secret keys in wp-config.php and reset administrator credentials if compromise is suspected

Patch Information

At the time of publication, refer to the Patchstack vulnerability database entry for the latest patched version guidance and vendor advisory updates.

Workarounds

Deploy a WAF rule blocking requests to ACPT endpoints containing serialized PHP object patterns
Temporarily deactivate the ACPT (Pro) plugin until a fixed version can be installed
Restrict Subscriber-role capabilities using a role management plugin to limit access to plugin endpoints
Enforce IP allowlisting on /wp-admin/ and authenticated plugin routes where feasible

bash

# Example ModSecurity rule to block serialized PHP objects in request bodies
SecRule REQUEST_BODY "@rx (?:O|a|s):\d+:\"" \
    "id:1032563,\
    phase:2,\
    deny,\
    status:403,\
    msg:'Potential PHP Object Injection - CVE-2026-32563',\
    tag:'cwe-502'"