Authorization Bypass in Custom Post Type UI Plugin for WordPress

CVE-2025-12826

What is CVE-2025-12826?

The Custom Post Type UI plugin for WordPress is susceptible to an authorization bypass vulnerability affecting all versions up to and including 1.18.0. This issue arises from the plugin's failure to validate whether a user possesses the required capabilities to perform actions within the 'cptui_process_post_type' function. Consequently, authenticated users with subscriber-level access and higher can potentially add, edit, or delete custom post types under certain conditions, posing significant security risks.

References