CVE-2025-12826
MediumCVSS 4.8Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
The Custom Post Type UI plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.18.0. This is due to the plugin not verifying that a user has the required capability to perform actions in the "cptui_process_post_type" function. This makes it possible for authenticated attackers, with subscriber level access and above, to add, edit, or delete custom post types in limited situations.
Risk Assessment
An authenticated attacker with low privileges can modify custom post types, potentially leading to unauthorized changes in the site's content structure.
Recommendation
Update the Custom Post Type UI plugin to a version later than 1.18.0 that fixes the authorization bypass.
Other vulnerabilities in Custom Post Type UI
Original NVD description (English source)
The Custom Post Type UI plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.18.0. This is due to the plugin not verifying that a user has the required capability to perform actions in the "cptui_process_post_type" function. This makes it possible for authenticated attackers, with subscriber level access and above, to add, edit, or delete custom post types in limited situations.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS