CVE-2025-12826

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2025-12826

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-12826.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-12826

Published

2025-12-04T06:48:40Z

Modified

2026-08-12T03:51:25Z

Severity

4.8 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L CVSS Calculator

Summary

Custom Post Type UI <= 1.18.0 - Missing Authorization to Unauthenticated (Previously Administrator+) Custom Post Type Modification

Details

The Custom Post Type UI plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.18.0. This is due to the plugin not verifying that a user has the required capability to perform actions in the "cptui_process_post_type" function. This makes it possible for authenticated attackers, with subscriber level access and above, to add, edit, or delete custom post types in limited situations.

Database specific

{
    "cna_assigner":  "Wordfence",
    "cwe_ids":  [
        "CWE-862"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/12xxx/CVE-2025-12826.json"
}

References

Affected packages

Git / github.com/webdevstudios/custom-post-type-ui

Affected ranges

Type

GIT

Repo

https://github.com/webdevstudios/custom-post-type-ui

Events

Introduced

Fixed

215779a5ac0c624f0dcf875e87305b4898d5bcf9

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "last_affected":  "1.18.0"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

0.*

0.8.1

0.9.0

1.*

1.0.0

1.0.1

1.0.2

1.0.4

1.0.5

1.0.7

1.0.8

1.1

1.1.1

1.1.2

1.1.3

1.10.0

1.10.1

1.10.2

1.11.0

1.11.1

1.11.2

1.12.0

1.12.1

1.13.0

1.13.1

1.13.2

1.13.3

1.13.4

1.13.5

1.13.6

1.13.7

1.14.0

1.15.0

1.15.1

1.16.0

1.17.0

1.17.1

1.17.2

1.17.3

1.18.0

1.2.0

1.2.1

1.2.2

1.2.3

1.2.4

1.3.0

1.3.1

1.3.2

1.3.3

1.4.0

1.4.1

1.5.0

1.5.1

1.6.1

1.7.0

1.7.1

1.7.2

1.7.4

1.7.5

1.8.0

1.8.1

1.8.2

1.9.0

1.9.1

1.9.2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-12826.json"