PT-2025-49007 · WordPress · Custom Post Type Ui
CVSS v3.1
4.8
Medium
| Vector | AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L |
Name of the Vulnerable Software and Affected Versions
Custom Post Type UI plugin for WordPress versions prior to 1.19.0
Description
The Custom Post Type UI plugin for WordPress is susceptible to authorization bypass. The plugin does not properly verify user capabilities when executing the
cptui process post type function. This allows authenticated attackers with subscriber-level access or higher to add, edit, or delete custom post types under specific circumstances.Recommendations
Update the Custom Post Type UI plugin to version 1.19.0 or later.
Exploit
Fix
Missing Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Custom Post Type Ui