CVE-2026-25470

CRITICAL

Improper Control of Generation of Code ('Code Injection') vulnerability in ACPT ACPT (Pro) - Custom Post Types Plugin for WordPress allows Remote Code Inclusion. This issue affects ACPT (Pro) - Custom Post Types Plugin for WordPress: from n/a through 2.0.47.

StatusDeferred

설명

Improper Control of Generation of Code ('Code Injection') vulnerability in ACPT ACPT (Pro) - Custom Post Types Plugin for WordPress allows Remote Code Inclusion.

This issue affects ACPT (Pro) - Custom Post Types Plugin for WordPress: from n/a through 2.0.47.

Score Summary

CVSS Score: 10.0
Version: 3.1
VPI: 100
Why this VPI (explainable, experimental)
VPI breakdown
Impact 100.00
Exploitation signal(No additional exploitation signal) ×1.00
VPI 100.00
VPI formula vpi-v1
EPSS: 0.4%
(상위 33.6%)
Attack Vector: Network
Low Complexity
No Privileges
No User Interaction
Scope Changed
High Confidentiality Impact
High Integrity Impact
High Availability Impact

Details

Published: 06/17/2026(last month)
Modified: 06/17/2026(last month)
Source: NVD

CWE Weakness Classification

CWE-94
NVD
Primary

References (1)

NVD
https://patchstack.com/database/wordpress/plugin/advanced-custom-post-type/vulnerability/wordpress-acpt-pro-custom-post-types-plugin-for-wordpress-plugin-2-0-47-remote-code-execution-rce-vulnerability?_s_id=cve

목록으로

Dashboard

Vulnerabilities

Impact	100.00
Exploitation signal(No additional exploitation signal)	×1.00
VPI	100.00