blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2026-105701

HIGH 8.8 CVSS 3.1
Published
October 6, 2026
Last modified
October 6, 2026
NVD status
Deferred
Reported by
security@wordfence.com
Weakness
CWE-434
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Description

The ACPT (Premium) plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.0.66 via the render function. This is due to missing capability check on the REST API form creation endpoint and unsandboxed Twig environment rendering email templates. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute code on the server. The exploit requires the attacker to first create a form with malicious email_settings via the REST API endpoint, then trigger form submission to execute the injected Twig expressions.

Affected products and versions

  • Mauro Cassani ACPT (Premium) — Up to and including 2.0.66

References

  • acpt.io https://acpt.io/changelog/
  • www.wordfence.com https://www.wordfence.com/threat-intel/vulnerabilities/id/9cd544ed-493e-4d4a-9eb8-ea83c47f3857?source=cve
  • nvd.nist.gov Official NVD record