Skip to content
Threat Feed
Subscribe

Vendor

ACPT

2 briefs RSS
high advisory

Remote Code Execution in ACPT (Premium) WordPress Plugin

Authenticated attackers with subscriber-level access can achieve remote code execution in ACPT (Premium) versions up to 2.0.66 by injecting malicious Twig expressions via the REST API.

ACPT wordpress rce web-application cve-2026-105701
2t 1c
critical advisory

Unauthenticated Privilege Escalation in ACPT Premium Plugin

The ACPT Premium WordPress plugin contains a critical authorization flaw in the submit() function, allowing unauthenticated attackers to hijack administrative accounts by overwriting credentials.

ACPT wordpress plugin-vulnerability privilege-escalation web-application
1t 1c