Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2

Export CSV
CVE-2026-15354

ACPT (Premium) <= 2.0.66 - Unauthenticated Privilege Escalation via 'acpt_form_post_id' Parameter

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-32566. Reason: This candidate is a reservation duplicate of CVE-2026-32566 Notes: All CVE users should reference CVE-2026-32566 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.

CVSS n/a EPSS n/a KEV · Not listed
Vendors
Mauro Cassani Wordpress
Products
Acpt (premium) Wordpress
CVE-2026-105701

ACPT (Premium) <= 2.0.66 - Authenticated (Subscriber+) Remote Code Execution via REST API Email Template

The ACPT (Premium) plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.0.66 via the render function. This is due to missing capability check on the REST API form creation endpoint and unsandboxed Twig environment rendering email templates. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute code on the server. The exploit requires the attacker to first create a form with malicious email_settings via the REST API endpoint, then trigger form submission to execute the injected Twig expressions.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Mauro Cassani Wordpress-extensions
Products
Acpt (premium) Acpt (premium)