WordPress ACPT (Pro) - Custom Post Types Plugin for WordPress plugin <= 2.0.63 - Privilege Escalation vulnerability

WordPress ACPT Pro - Custom Post Types Plugin for WordPress plugin = 2.0.63 - Privilege Escalation vulnerability discovered by VDsec in WordPress Plugin ACPT Pro - Custom Post Types Plugin for WordPress versions = 2.0.63...

CVE-2026-74586

creationtimestamp| type| source ---|---|--- 2026-08-25 06:10:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mtv5u3hm5a23 2026-09-09 16:00:06+00:00| seen| Telegram/idrq8GCshAndCL-cMA1Uoj2VzIrne5jNTdbo8AkO8RR-nM 2026-09-09 16:00:07+00:00| published-proof-of-concept|...

CVE-2026-75930

The FundEngine – Donation and Crowdfunding Platform plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.8.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated...

CVE-2026-75930 FundEngine <= 1.8.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Modification via 'campaign_post' Parameter

The FundEngine – Donation and Crowdfunding Platform plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.8.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated...

CVE-2026-75930

FundEngine – Donation and Crowdfunding Platform for WordPress (all versions up to and including 1.8.1 ) suffers from an authorization bypass due to missing authorization verification. An authenticated attacker with subscriber-level access or above can modify arbitrary posts and pages — overwritin...

CVE-2026-72702

creationtimestamp| type| source ---|---|--- 2026-08-25 03:10:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mtutsbu6id25 2026-08-25 04:08:07+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mtuwzzyhhc2c 2026-08-25 04:30:24+00:00| seen|...

CVE-2026-56707

creationtimestamp| type| source ---|---|--- 2026-08-25 02:25:17+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mturc5bqhs2j...

CVE-2026-56710

creationtimestamp| type| source ---|---|--- 2026-08-25 02:10:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mtuqgxw2sc2u 2026-08-25 04:07:50+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mtuwzjuvpw2p...

EUVD-2026-65158

A flaw has been found in Faveo Helpdesk up to 2.0.3. This impacts the function FormController::postticketreply of the file app/Http/Controllers/Client/helpdesk/FormController.php of the component post-ticket-reply Endpoint. This manipulation causes missing authentication. The attack can be...

EUVD-2026-65167

Subscriber PHP Object Injection in ACPT Pro - Custom Post Types Plugin for WordPress = 2.0.63 versions...

CVE-2026-42167 - ProFTPD mod_sql post-authentication SQLi - RCE

!/usr/bin/env python3 """ CVE-2026-42167 — ProFTPD modsql post-authentication SQL injection - RCE postauthstorrce.py --host --port 21 \ --user --password \ --shell-host --shell-port 4444 SUMMARY ------- ProFTPD's modsql logs FTP activity through user-supplied SQL. Its escaping helper isescapedtex...

PT-2026-81271

The Newsletters plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.17. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with author-level access and...

CVE-2026-77337

creationtimestamp| type| source ---|---|--- 2026-08-24 23:20:03+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mtugwwvdb72p 2026-08-25 00:08:06+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mtujmtqa4j24 2026-08-25 01:12:31+00:00| seen|...

CVE-2026-32555

creationtimestamp| type| source ---|---|--- 2026-08-24 23:00:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mtuftb6did2m 2026-08-25 00:07:42+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mtujlzxlnb25 2026-08-25 01:12:41+00:00| seen|...

CVE-2026-78434

A flaw has been found in Faveo Helpdesk up to 2.0.3. This impacts the function FormController::postticketreply of the file app/Http/Controllers/Client/helpdesk/FormController.php of the component post-ticket-reply Endpoint. This manipulation causes missing authentication. The attack can be...

CVE-2026-32563

Subscriber PHP Object Injection in ACPT Pro - Custom Post Types Plugin for WordPress = 2.0.63 versions...

CVE-2026-78266

creationtimestamp| type| source ---|---|--- 2026-08-24 22:14:28+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/ahzqsf6v2jvpj...

CVE-2026-19568

creationtimestamp| type| source ---|---|--- 2026-08-24 22:02:09+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mtucllupjp2l...

CVE-2026-32563 WordPress ACPT (Pro) - Custom Post Types Plugin for WordPress plugin <= 2.0.63 - PHP Object Injection vulnerability

Subscriber PHP Object Injection in ACPT Pro - Custom Post Types Plugin for WordPress = 2.0.63 versions...

CVE-2026-32563

CVE-2026-32563 is a PHP Object Injection vulnerability in the ACPT (Pro) – Custom Post Types Plugin for WordPress , affecting versions ≤ 2.0.63 . The vulnerability requires Subscriber -level access as stated in the description, though the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) rates Pr...