High · 8.8 CVE-2025-60208 EUVD-2025-35418GHSA-3x9q-xwx4-hhr3

WordPress Advanced Custom Fields : CPT Options Pages plugin <= 2.0.9 - Cross Site Request Forgery (CSRF) vulnerability

Published Oct 22, 2025 · Updated Apr 28, 2026 · Assigned by Patchstack

Vendor: Tusko Trush Product: Advanced Custom Fields : CPT Options Pages

Description

Cross-Site Request Forgery (CSRF) vulnerability in Tusko Trush Advanced Custom Fields : CPT Options Pages acf-cpt-options-pages allows Object Injection.This issue affects Advanced Custom Fields : CPT Options Pages: from n/a through <= 2.0.9.

Affected products

Vendor	Product	Affected	Fixed
Tusko Trush	Advanced Custom Fields : CPT Options Pages	≤ 2.0.9	—

References

https://patchstack.com/database/Wordpress/Plugin/acf-cpt-options-pages/vulnerability/wordpress-advanced-custom-fields-cpt-options-pages-plugin-2-0-9-cross-site-request-forgery-csrf-vulnerability?_s_id=cve vdb-entry