CVE-2026-105701: ACPT (Premium) <= 2.0.66 - Authenticated (Subscriber+) Remote Code Execution via REST API Email Template
The ACPT (Premium) plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.0.66 via the render function. This is due to missing capability check on the REST API form creation endpoint and unsandboxed Twig environment rendering email templates. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute code on the server. The exploit requires the attacker to first create a form with malicious emailsettings via the REST API endpoint, then trigger form submission to execute the injected Twig expressions.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated WordPress user with Subscriber-level access or higher can exploit it. The attack does not require user interaction.
What does an attacker need to do to trigger code execution?
The attacker must create a form through the REST API with malicious email_settings, then trigger a submission for that form. The injected Twig expressions execute when the email template is rendered.
Are default access controls sufficient to prevent exploitation?
No. The affected REST API form-creation endpoint lacks a capability check, allowing Subscriber-level users to create the required malicious form configuration.
How can administrators assess whether they are exposed?
Check whether ACPT (Premium) is installed at version 2.0.66 or earlier and whether untrusted users can authenticate with Subscriber-level or greater access. Review form creation activity and email_settings for unexpected Twig expressions or unauthorized forms.