> For the complete documentation index, see [llms.txt](https://docs.acpt.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.acpt.io/security-issues/security-advisory-php-object-injection-vulnerability-fixed-in-acpt-2.0.67.md).

# Security Advisory: PHP Object Injection Vulnerability Fixed in ACPT 2.0.67

**Published:** August 18, 2026\
**Applies to:** ACPT versions **<= 2.0.66**\
**Fixed in:** **2.0.67**\
**Severity:** Critical (CVSS 9.8)\
**Reference:** Reported by Patchstack (reference pending)

***

### Summary

A **PHP Object Injection** vulnerability affecting ACPT versions **2.0.66 and earlier** has been reported by Patchstack, a third-party security research firm, and has been **fully resolved in version 2.0.67**.

We strongly recommend that all users update to the latest available version of ACPT.

***

### What Happened

Certain data stored by ACPT's Forms feature was read back using PHP's native `unserialize()` function without restricting which types of data it was allowed to reconstruct. When `unserialize()` is used this way, a specially crafted value can cause PHP to create unintended objects instead of the plain data (arrays, numbers, text) that was expected — a technique known as **PHP Object Injection**. Depending on what other code happens to be present in a given environment, this can potentially be chained into further compromise.

An authenticated user with access to ACPT's form-configuration features could store such a crafted value in a form's settings. That value could then be read back — including through the public, unauthenticated act of submitting the form itself — triggering the unintended object creation.

Version 2.0.67 restricts this deserialization so that it can never reconstruct an object, regardless of what value is supplied, while continuing to correctly support the plugin's legitimate data (arrays and simple values).

As part of remediating this report, we also proactively reviewed every other location in the plugin that performs similar deserialization and applied the same restriction, even where no specific vulnerability had been demonstrated.

***

### Affected Versions

| Version   | Status     |
| --------- | ---------- |
| <= 2.0.66 | Vulnerable |
| >= 2.0.67 | Fixed      |

***

### What You Should Do

#### Immediate Action

If you are running an older version of ACPT:

1. Update ACPT immediately to the latest version.
2. Ensure WordPress core, themes, and plugins are updated.
3. Review your Forms and their configured metadata for anything unfamiliar.
4. Scan your website using your preferred security tool.

***

### Our Security Commitment

Security is a top priority for ACPT. We work with third-party security researchers, including Patchstack, to identify and resolve issues quickly, and we continuously review our codebase for similar patterns beyond the specific report.

***

### Frequently Asked Questions

#### Was ACPT patched before public disclosure?

Yes. The issue was privately reported by Patchstack and fixed in **2.0.67** as part of our standard responsible-disclosure process.

#### Do I need to upgrade if my site works fine?

Yes. Security updates should always be applied regardless of current functionality.

#### Is the latest version safe?

Yes. Versions **2.0.67+** resolve this issue. We still recommend always running the latest available release.

***

### Need Help?

If you need assistance updating ACPT or verifying your installation, contact our support team through the official website.