CVE-2026-32566: WordPress ACPT Privilege Escalation Flaw

CVE-2026-32566 is an unauthenticated privilege escalation vulnerability in the ACPT Custom Post Types plugin for WordPress versions up to 2.0.63. Attackers can gain elevated access without credentials. This article covers technical details, affected versions, security impact, and mitigation strategies.

CVE-2026-32566 Overview

CVE-2026-32566 is an unauthenticated privilege escalation vulnerability in the ACPT (Pro) - Custom Post Types plugin for WordPress. The flaw affects all plugin versions up to and including 2.0.63. Remote attackers can escalate privileges without authentication or user interaction over the network. The weakness maps to CWE-266: Incorrect Privilege Assignment. Successful exploitation allows an unauthenticated actor to obtain elevated WordPress capabilities, which can lead to full site compromise, arbitrary content modification, and pivoting to server-level access.

Critical Impact
Unauthenticated attackers can obtain elevated privileges in WordPress sites running ACPT (Pro) <= 2.0.63, enabling full site takeover.

Affected Products

ACPT (Pro) - Custom Post Types Plugin for WordPress, versions <= 2.0.63
WordPress installations with the vulnerable plugin activated
Any hosting environment exposing affected WordPress sites to the network

Discovery Timeline

2026-08-27 - CVE-2026-32566 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-32566

Vulnerability Analysis

The vulnerability is an unauthenticated privilege escalation in the ACPT (Pro) Custom Post Types plugin. An attacker sends crafted HTTP requests to a vulnerable endpoint exposed by the plugin. The endpoint fails to enforce proper capability checks before performing privileged operations. As a result, an anonymous request can perform actions that should be restricted to administrators.

Because WordPress plugins run inside the site's PHP context, a successful escalation grants the attacker administrator-equivalent capabilities. From there, the attacker can install malicious plugins, modify themes, create administrator accounts, or execute arbitrary PHP. This transforms a plugin-level flaw into full site compromise.

Root Cause

The root cause is incorrect privilege assignment [CWE-266]. The plugin assigns or accepts elevated privileges without validating the caller's identity or capability. Missing current_user_can() checks, absent nonce verification, or trust in client-supplied role parameters are common patterns that produce this class of defect. Refer to the Patchstack advisory for vendor-confirmed technical details.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker issues an HTTP or HTTPS request directly to the vulnerable plugin endpoint on the target WordPress site. Automated scanners can identify vulnerable installations by fingerprinting plugin version metadata. No verified public proof-of-concept exploit code is currently available.

See the Patchstack advisory for CVE-2026-32566 for endpoint-level technical detail.

Detection Methods for CVE-2026-32566

Indicators of Compromise

Unexpected WordPress administrator accounts created outside normal provisioning windows.
Modifications to wp_users and wp_usermeta tables assigning administrator roles to unfamiliar accounts.
New or altered plugin and theme files, especially PHP files with obfuscated payloads or eval() calls.
HTTP requests to ACPT plugin endpoints under /wp-admin/admin-ajax.php or /wp-json/ from unauthenticated sources.

Detection Strategies

Inventory installed WordPress plugins and flag ACPT (Pro) versions <= 2.0.63.
Correlate web server access logs for anonymous requests to ACPT plugin routes followed by role or user changes.
Alert on WordPress audit-log events showing role elevation without a preceding authenticated admin session.

Monitoring Recommendations

Enable a WordPress activity logging plugin and forward events to a central SIEM.
Monitor file integrity for wp-content/plugins/, wp-content/themes/, and wp-config.php.
Track outbound connections from the web server to identify post-exploitation callbacks.

How to Mitigate CVE-2026-32566

Immediate Actions Required

Update ACPT (Pro) to a version above 2.0.63 as soon as the vendor patch is available.
Audit all WordPress administrator accounts and remove any that are unauthorized.
Rotate credentials, API keys, and secrets stored in wp-config.php if compromise is suspected.
Restrict access to /wp-admin/ and REST API endpoints using IP allowlists where feasible.

Patch Information

Consult the Patchstack vulnerability report for the current fixed version and vendor guidance. Apply the update through the WordPress plugin dashboard or replace the plugin directory with the patched release.

Workarounds

Deactivate and remove the ACPT (Pro) plugin until a patched release is installed.
Deploy a Web Application Firewall rule blocking anonymous requests to ACPT plugin endpoints.
Enforce two-factor authentication for all WordPress administrator accounts to limit post-exploit persistence.

bash

# Configuration example: disable the vulnerable plugin via WP-CLI
wp plugin deactivate advanced-custom-post-type
wp plugin delete advanced-custom-post-type

# Verify no unauthorized administrators remain
wp user list --role=administrator --fields=ID,user_login,user_email,user_registered