Critical · 10.0 CVE-2026-25470 EUVD-2026-37503GHSA-3xc6-wgx8-2ffv

WordPress ACPT (Pro) - Custom Post Types plugin for WordPress plugin < 2.0.52 - Remote Code Execution (RCE) vulnerability

Published Jun 16, 2026 · Updated Sep 14, 2026 · Assigned by Patchstack

Description

Unauthenticated Remote Code Execution (RCE) in ACPT (Pro) - Custom Post Types Plugin for WordPress <= 2.0.47 versions.

Vendor	Product	Affected	Fixed
ACPT	ACPT (Pro) - Custom Post Types Plugin for WordPress	< 2.0.52	2.0.52