Security Advisory: Remote Code Execution (RCE) Vulnerability Fixed in ACPT 2.0.52

Published: 2026-04-27 Applies to: ACPT versions <= 2.0.47 Fixed in: 2.0.52 Severity: High Reference: CVE-2026-25470

---

Summary

A Remote Code Execution (RCE) vulnerability affecting older versions of ACPT (Advanced Custom Post Types) has been publicly reported by third-party security vendors.

The issue impacts ACPT versions 2.0.47 and earlier and was fully resolved in version 2.0.52, released on 2026-02-04.

We strongly recommend that all users update to the latest available version of ACPT.

---

What Happened

The vulnerability was related to legacy internal code paths involving dynamic PHP execution logic.

As part of our security hardening process, version 2.0.52 introduced a complete refactor of the internal PHPEval class and removed the use of the include() function.

Official changelog entry (2.0.52)

Complete refactoring of PHPEval class. Removed include() function.

This change eliminated the vulnerable execution path and improved the plugin’s overall security model.

---

Affected Versions

Version	Status
<= 2.0.47	Vulnerable
2.0.48 – 2.0.51	Transitional / update recommended
>= 2.0.52	Fixed

---

What You Should Do

Immediate Action

If you are running an older version of ACPT:

1. Update ACPT immediately to the latest version.

2. Ensure WordPress core, themes, and plugins are updated.

3. Review administrator accounts and permissions.

4. Scan your website using your preferred security tool.

---

Our Security Commitment

Security is a top priority for ACPT. We continuously review internal architecture, remove legacy patterns, and improve secure coding standards across the plugin.

The refactor introduced in 2.0.52 was part of this ongoing effort.

---

Frequently Asked Questions

Was ACPT proactively patched before public disclosure?

Yes. The issue was fixed in 2.0.52, released on 2026-02-04, before many public vulnerability feeds began surfacing the report.

Do I need to upgrade if my site works fine?

Yes. Security updates should always be applied regardless of current functionality.

Is the latest version safe?

Yes. Versions 2.0.52+ removed the affected code path. We still recommend always running the latest available release.

---

Need Help?

If you need assistance updating ACPT or verifying your installation, contact our support team through the official website.