> For the complete documentation index, see [llms.txt](https://docs.acpt.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.acpt.io/security-issues/security-advisory-privilege-escalation-vulnerability-fixed-in-acpt-2.0.67.md).

# Security Advisory: Privilege Escalation Vulnerability Fixed in ACPT 2.0.67

**Published:** August 18, 2026\
**Applies to:** ACPT versions **<= 2.0.66**\
**Fixed in:** **2.0.67**\
**Severity:** Critical (CVSS 9.8)\
**Reference:** Reported by Patchstack (reference pending)

***

### Summary

A **Privilege Escalation** vulnerability affecting ACPT versions **2.0.66 and earlier** has been reported by Patchstack, a third-party security research firm, and has been **fully resolved in version 2.0.67**.

This was the most severe of the issues addressed in this release and could, in the affected scenario, allow an attacker to take over an administrator account. We strongly recommend that all users update immediately.

***

### What Happened

ACPT's Forms feature can be configured to create a new WordPress user, post, or term when a visitor submits a form (for example, a public "sign up" or "submit a listing" form). The logic that decided whether a submission should **create** a new record or **update** an existing one relied on a value included in the submitted form data, without verifying that the person submitting the form actually had permission to modify the record being targeted.

As a result, an anonymous or low-privileged visitor filling out a public form could potentially cause the submission to update a different, unrelated user, post, or term instead of creating a new one — including, in the case of a user-creation form, an existing administrator account, whose email address and password could then be overwritten with attacker-controlled values.

Version 2.0.67 now verifies, using WordPress's own built-in capability system, that any update triggered by a form submission is actually permitted before it is allowed to proceed.

***

### Affected Versions

| Version   | Status     |
| --------- | ---------- |
| <= 2.0.66 | Vulnerable |
| >= 2.0.67 | Fixed      |

***

### What You Should Do

#### Immediate Action

If you are running an older version of ACPT:

1. **Update ACPT immediately to the latest version.** This is the most important step for this issue.
2. Review your administrator accounts for any unrecognized changes to email addresses or unexpected password resets.
3. If you have any public-facing forms configured to create WordPress users, posts, or terms, review recent submissions for anything suspicious.
4. Ensure WordPress core, themes, and plugins are updated.
5. Scan your website using your preferred security tool.

***

### Our Security Commitment

Security is a top priority for ACPT. We work with third-party security researchers, including Patchstack, to identify and resolve issues quickly, and we continuously review our codebase for similar patterns beyond the specific report.

***

### Frequently Asked Questions

#### Was ACPT patched before public disclosure?

Yes. The issue was privately reported by Patchstack and fixed in **2.0.67** as part of our standard responsible-disclosure process.

#### Do I need to upgrade if my site works fine?

Yes. Security updates should always be applied regardless of current functionality — this issue would not have produced any visible symptoms on its own.

#### Is the latest version safe?

Yes. Versions **2.0.67+** resolve this issue. We still recommend always running the latest available release.

***

### Need Help?

If you need assistance updating ACPT, verifying your installation, or reviewing your administrator accounts, contact our support team through the official website.