ACPT (Premium) WordPress plugin: Remote code execution via REST API forms
Summary
The ACPT (Premium) WordPress plugin up to and including 2.0.66 allows authenticated users with subscriber-level access or higher to execute code on the web server. The REST API endpoint for creating forms lacks a capability check, and email templates are rendered by an unsandboxed Twig environment. An attacker first creates a form with malicious email settings and then triggers a form submission to run the injected expressions. Sites that allow open registration are at the highest risk.
Affected
- ACPT (Premium) WordPress plugin, all versions up to and including 2.0.66
Fixed in
Unknown. A fixed version is probably 2.0.67, but this is not confirmed for this CVE.
Workaround
- Disable open self-registration and review or remove unneeded subscriber accounts
- Review existing ACPT forms and their email settings for unexpected template content
- Deactivate ACPT (Premium) if forms are not in use
Exploitation
Unknown. No public proof-of-concept exploit was found. The sources reviewed do not list the CVE as known exploited, but the CISA KEV catalog has not been verified.
Our recommendation
- Update ACPT (Premium) to the latest version, at least 2.0.67 once the vendor has confirmed the fix
- Check whether your WordPress site accepts registrations or has subscriber accounts
- Review forms and REST API logs for unknown or recently created forms
- Monitor the web server for unusual process activity
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Wordfence advisory www.wordfence.com
- ACPT changelog acpt.io
- ACPT 2.0.67 security advisory (PHP Object Injection) docs.acpt.io
- ACPT download and documentation docs.acpt.io
- VulDB CVE-2026-105701 vuldb.com
- Strix CVE-2026-105701 www.strix.ai
- OpenCVE affected products app.opencve.io
- GitHub CVE issue 1189 (EPSS and status) github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 22:28.
Original description (NVD)
The ACPT (Premium) plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.0.66 via the render function. This is due to missing capability check on the REST API form creation endpoint and unsandboxed Twig environment rendering email templates. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute code on the server. The exploit requires the attacker to first create a form with malicious email_settings via the REST API endpoint, then trigger form submission to execute the injected Twig expressions.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.