> For the complete documentation index, see [llms.txt](https://docs.acpt.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.acpt.io/security-issues/security-advisory-sql-injection-vulnerability-fixed-in-acpt-2.0.67.md).

# Security Advisory: SQL Injection Vulnerability Fixed in ACPT 2.0.67

**Published:** August 18, 2026\
**Applies to:** ACPT versions **<= 2.0.66**\
**Fixed in:** **2.0.67**\
**Severity:** High (CVSS 8.5)\
**Reference:** Reported by Patchstack (reference pending)

***

### Summary

A **SQL Injection** vulnerability affecting ACPT versions **2.0.66 and earlier** has been reported by Patchstack, a third-party security research firm, and has been **fully resolved in version 2.0.67**.

We strongly recommend that all users update to the latest available version of ACPT.

***

### What Happened

The vulnerability was located in the WooCommerce integration's routine for cleaning up orphaned product-data fields. That routine built part of a database query directly from client-supplied identifiers without properly escaping them. A specially crafted identifier could interfere with the intended query, potentially exposing or deleting data beyond what was intended.

Exploiting this issue required an authenticated WordPress account, including low-privileged roles such as Subscriber. This was possible because of a related, broader issue in the plugin's REST API: certain endpoints only verified that a request came from *some* valid WordPress account, without checking whether that account actually had permission to perform the action. Version 2.0.67 also closes that access-control gap, requiring administrator-level capability for these REST API endpoints — which independently prevents this and similar issues from being reachable by lower-privileged accounts.

***

### Affected Versions

| Version   | Status     |
| --------- | ---------- |
| <= 2.0.66 | Vulnerable |
| >= 2.0.67 | Fixed      |

***

### What You Should Do

#### Immediate Action

If you are running an older version of ACPT:

1. Update ACPT immediately to the latest version.
2. Ensure WordPress core, themes, and plugins are updated.
3. Review user accounts and remove any you don't recognize.
4. Scan your website using your preferred security tool.

***

### Our Security Commitment

Security is a top priority for ACPT. We work with third-party security researchers, including Patchstack, to identify and resolve issues quickly, and we continuously review our codebase for similar patterns beyond the specific report.

***

### Frequently Asked Questions

#### Was ACPT patched before public disclosure?

Yes. The issue was privately reported by Patchstack and fixed in **2.0.67** as part of our standard responsible-disclosure process.

#### Do I need to upgrade if my site works fine?

Yes. Security updates should always be applied regardless of current functionality.

#### Is the latest version safe?

Yes. Versions **2.0.67+** resolve this issue. We still recommend always running the latest available release.

***

### Need Help?

If you need assistance updating ACPT or verifying your installation, contact our support team through the official website.