Unauthorized Custom Taxonomy Deletion in Ace Post Type Builder for WordPress

CVE-2025-13405

What is CVE-2025-13405?

The Ace Post Type Builder plugin for WordPress has a security flaw allowing authenticated users with Subscriber-level access or higher to delete arbitrary custom taxonomies. This issue arises from the lack of necessary authorization checks within the cptb_delete_custom_taxonomy() function. As a result, attackers can exploit this weakness to manipulate or remove critical taxonomy data, potentially disrupting website functionality.

References