CVE-2025-12826 — Vulnerability intelligence
—
Published:
- CVSS
- 4.8
- CISA KEV
- Not listed; not proof of no exploitation
Original source text (not a translation)
The Custom Post Type UI plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.18.0. This is due to the plugin not verifying that a user has the required capability to perform actions in the "cptui_process_post_type" function. This makes it possible for authenticated attackers, with subscriber level access and above, to add, edit, or delete custom post types in limited situations.