CVE-2026-105701
ACPT (Premium) <= 2.0.66 - Authenticated (Subscriber+) Remote Code Execution via REST API Email Template
CVSS Score
8.8
EPSS Score
0.0%
EPSS Percentile
0th
The ACPT (Premium) plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.0.66 via the render function. This is due to missing capability check on the REST API form creation endpoint and unsandboxed Twig environment rendering email templates. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute code on the server. The exploit requires the attacker to first create a form with malicious email_settings via the REST API endpoint, then trigger form submission to execute the injected Twig expressions.
| CWE | CWE-434 |
| Vendor | mauro cassani |
| Product | acpt (premium) |
| Published | Oct 6, 2026 |
Stay Ahead of the Next One
Get instant alerts for mauro cassani acpt (premium)
Be the first to know when new high vulnerabilities affecting mauro cassani acpt (premium) are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
Mauro Cassani / ACPT (Premium)
0 ≤ 2.0.66
References
Credits
d.v4n_s3c