CVE-2026-105701

Name of the Vulnerable Software and Affected Versions ACPT (Premium) plugin for WordPress versions prior to 2.0.67

Description Authenticated attackers with subscriber-level access and above can achieve Remote Code Execution on the server. The issue stems from a missing capability check on the REST API form creation endpoint and an unsandboxed Twig environment used for rendering email templates. An attacker can exploit this by creating a form with malicious email settings via the REST API endpoint and subsequently triggering a form submission to execute injected Twig expressions through the render() function.

Recommendations Update the ACPT (Premium) plugin for WordPress to version 2.0.67 or later.