ACPT (Premium)

ACPT (Premium) has 5 disclosed vulnerabilities in the WordSec catalog, all reported in 2026; 1 is fixed and 4 remain unpatched as of September 2026. Their average CVSS score is 8.7, and the most serious one scores 9.8 out of 10. Severity breakdown: 3 critical and 1 high. 2026 was the busiest year with 5 disclosures.

The most common weakness is Improper Privilege Management, behind 2 of the records (40%). Other recurring categories include Code Injection, Deserialization Of Untrusted Data.

1 of the records (20%) have a vendor fix, while 4 remain unpatched. The oldest unresolved one dates back to 2026.

3 independent researchers contributed these findings, most of them (3) reported by VDsec.

Strategic Overview

Avg CVSSHigh

8.7/ 10

Patch Coverage20%

Open

Fixed

Get automatic notifications for all ACPT (Premium) vulnerabilities before they are exploited.

Most severe open issueCVSS 9.8CVE-2026-32566

ACPT (Premium) <= 2.0.63 - Unauthenticated Privilege Escalation

Read the full analysis

Vulnerability Records

5 records


2026-09-03 18:24	ACPT (Premium) <= 2.0.66 - Unauthenticated Privilege Escalation via 'acpt_form_post_id' Parameter ACPT (Premium) <= 2.0.66	`CVE-2026-15354`	9.8 Critical	d.v4n_s3c	Yes
2026-08-25 00:00	ACPT (Premium) <= 2.0.63 - Authenticated (Subscriber+) SQL Injection ACPT (Premium) <= 2.0.63	`CVE-2026-32564`	6.5 Medium	VDsec	No
2026-08-25 00:00	ACPT (Premium) <= 2.0.63 - Unauthenticated Privilege Escalation ACPT (Premium) <= 2.0.63	`CVE-2026-32566`	9.8 Critical	VDsec	No
2026-08-24 12:21	ACPT (Premium) <= 2.0.63 - Authenticated (Subscriber+) PHP Object Injection ACPT (Premium) <= 2.0.63	`CVE-2026-32563`	7.5 High	VDsec	No
2026-03-16 00:00	ACPT (Pro) - Custom Post Types Plugin for WordPress <= 2.0.47 - Unauthenticated Remote Code Execution ACPT (Premium) <= 2.0.47	`CVE-2026-25470`	9.8 Critical	Jarno Vos (jarnovos)	No

Showing 1–5 of 5 reports