CVE-2026-32564 Overview
CVE-2026-32564 is a SQL injection vulnerability in the ACPT (Pro) Custom Post Types plugin for WordPress. The flaw affects plugin versions up to and including 2.0.63. Authenticated users holding only the Subscriber role can exploit the vulnerability over the network.
The issue is tracked under CWE-89: Improper Neutralization of Special Elements used in an SQL Command. Successful exploitation lets an attacker inject arbitrary SQL into database queries executed by the plugin. This exposes sensitive WordPress data and can extend impact beyond the plugin's own scope.
Critical Impact
Authenticated Subscriber-level attackers can execute arbitrary SQL queries against the WordPress database, leading to confidentiality loss and potential availability degradation.
Affected Products
- ACPT (Pro) Custom Post Types Plugin for WordPress, versions <= 2.0.63
- WordPress installations running the vulnerable plugin
- Sites where the Subscriber role is enabled (default on many WordPress deployments)
Discovery Timeline
- 2026-08-27 - CVE-2026-32564 published to NVD
- 2026-08-27 - Last updated in NVD database
Technical Details for CVE-2026-32564
Vulnerability Analysis
The ACPT (Pro) plugin extends WordPress with custom post type management features. One or more plugin endpoints accept user-supplied parameters and concatenate them into SQL statements without proper sanitization or parameterized queries. Attackers authenticated as a Subscriber, the lowest privileged WordPress role, can reach the affected endpoints and inject SQL syntax.
Because the scope indicator changes when the vulnerability is triggered, the injection reaches database context beyond the plugin's own logical boundary. This means attackers can query WordPress core tables such as wp_users and wp_usermeta, potentially extracting password hashes, session tokens, and other secrets.
The integrity impact is rated none, indicating the primary risk is data disclosure rather than direct record modification. Availability impact is limited, but crafted payloads using time-based techniques or heavy queries can degrade database responsiveness.
Root Cause
The root cause is improper neutralization of special elements used in SQL commands [CWE-89]. Plugin code passes untrusted request parameters into SQL statements without using WordPress prepared statement helpers such as $wpdb->prepare() with placeholders. Refer to the Patchstack advisory for parameter-level details.
Attack Vector
An attacker registers or acquires a Subscriber account on the target WordPress site. The attacker then sends crafted HTTP requests to a vulnerable plugin endpoint, embedding SQL fragments in the affected parameter. The injected SQL executes with the database privileges of the WordPress user, typically granting full read access to all site tables.
Exploitation requires no user interaction and can be automated with standard tooling such as sqlmap. Sites that allow open user registration are at higher risk because attackers can self-provision the required Subscriber account.
No verified public exploit code is available at publication time. See the Patchstack advisory for technical details.
Detection Methods for CVE-2026-32564
Indicators of Compromise
- HTTP requests to ACPT plugin endpoints from Subscriber accounts containing SQL metacharacters such as ', UNION SELECT, SLEEP(, or INFORMATION_SCHEMA.
- Unusually long response times on plugin endpoints, indicative of time-based blind SQL injection.
- Database error messages or 500 responses returned from admin-ajax.php or REST routes registered by the plugin.
- Newly created low-privilege user accounts that immediately begin interacting with plugin endpoints.
Detection Strategies
- Inspect web server access logs for query strings and POST bodies targeting advanced-custom-post-type routes containing SQL syntax.
- Enable MySQL general query or slow query logging and alert on unexpected UNION, subquery, or INFORMATION_SCHEMA access from the WordPress database user.
- Deploy web application firewall rules that flag SQL injection payload patterns on authenticated plugin endpoints.
Monitoring Recommendations
- Correlate authentication events with plugin endpoint access to surface Subscriber accounts probing administrative functionality.
- Monitor for spikes in 4xx and 5xx responses from the plugin, which often accompany injection fuzzing.
- Track outbound data volumes from the database host to detect bulk extraction attempts.
How to Mitigate CVE-2026-32564
Immediate Actions Required
- Update the ACPT (Pro) Custom Post Types plugin to a version later than 2.0.63 as soon as a fixed release is available from the vendor.
- Audit WordPress user accounts and remove unrecognized Subscriber-level accounts.
- Disable open user registration under Settings > General if it is not required for site operations.
- Rotate WordPress secrets in wp-config.php and reset user passwords if exploitation is suspected.
Patch Information
Refer to the Patchstack advisory for CVE-2026-32564 for the latest fixed version and remediation guidance from the vendor.
Workarounds
- Deactivate the ACPT (Pro) plugin until a patched version can be installed.
- Deploy virtual patching through a WordPress-aware web application firewall to block SQL injection payloads on plugin endpoints.
- Restrict access to wp-admin and admin-ajax.php from untrusted networks where feasible.
- Apply least privilege to the MySQL user in wp-config.php so it cannot read tables outside the WordPress schema.
# Configuration example: temporarily deactivate the vulnerable plugin via WP-CLI
wp plugin deactivate advanced-custom-post-type
wp plugin status advanced-custom-post-type
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
