PT-2025-49007

CVE-2025-12826

Published

2025-12-03

Updated

2025-12-04

Description by

CVSS 3.1

4.8

Medium

MetricsAV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions Custom Post Type UI plugin for WordPress versions prior to 1.19.0

Description The Custom Post Type UI plugin for WordPress is susceptible to authorization bypass. The plugin does not properly verify user capabilities when executing the cptui process post type function. This allows authenticated attackers with subscriber-level access or higher to add, edit, or delete custom post types under specific circumstances.

Recommendations Update the Custom Post Type UI plugin to version 1.19.0 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Mahdi Salhi

Vendors

Affected products

Weakness enumeration

CWE-862: Missing Authorization

Related identifiers