> For the complete documentation index, see [llms.txt](https://docs.acpt.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.acpt.io/security-issues/security-advisory-remote-code-execution-rce-vulnerability-fixed-in-acpt-2.0.52.md).

# Security Advisory: Remote Code Execution (RCE) Vulnerability Fixed in ACPT 2.0.52

**Published:** 2026-04-27\
**Applies to:** ACPT versions **<= 2.0.47**\
**Fixed in:** **2.0.52**\
**Severity:** High\
**Reference:** CVE-2026-25470

***

### Summary

A **Remote Code Execution (RCE)** vulnerability affecting older versions of **ACPT (Advanced Custom Post Types)** has been publicly reported by third-party security vendors.

The issue impacts **ACPT versions 2.0.47 and earlier** and was **fully resolved in version 2.0.52**, released on **2026-02-04**.

We strongly recommend that all users update to the latest available version of ACPT.

***

### What Happened

The vulnerability was related to legacy internal code paths involving dynamic PHP execution logic.

As part of our security hardening process, version **2.0.52** introduced a complete refactor of the internal `PHPEval` class and removed the use of the `include()` function.

#### Official changelog entry (2.0.52)

> Complete refactoring of `PHPEval` class. Removed `include()` function.

This change eliminated the vulnerable execution path and improved the plugin’s overall security model.

***

### Affected Versions

| Version         | Status                            |
| --------------- | --------------------------------- |
| <= 2.0.47       | Vulnerable                        |
| 2.0.48 – 2.0.51 | Transitional / update recommended |
| >= 2.0.52       | Fixed                             |

***

### What You Should Do

#### Immediate Action

If you are running an older version of ACPT:

1. Update ACPT immediately to the latest version.
2. Ensure WordPress core, themes, and plugins are updated.
3. Review administrator accounts and permissions.
4. Scan your website using your preferred security tool.

***

### Our Security Commitment

Security is a top priority for ACPT. We continuously review internal architecture, remove legacy patterns, and improve secure coding standards across the plugin.

The refactor introduced in **2.0.52** was part of this ongoing effort.

***

### Frequently Asked Questions

#### Was ACPT proactively patched before public disclosure?

Yes. The issue was fixed in **2.0.52**, released on **2026-02-04**, before many public vulnerability feeds began surfacing the report.

#### Do I need to upgrade if my site works fine?

Yes. Security updates should always be applied regardless of current functionality.

#### Is the latest version safe?

Yes. Versions **2.0.52+** removed the affected code path. We still recommend always running the latest available release.

***

### Need Help?

If you need assistance updating ACPT or verifying your installation, contact our support team through the official website.