An unauthenticated PHP Object Injection vulnerability in the ACPT (Pro) WordPress plugin poses a critical risk of remote code execution and full application compromise.

The plugin fails to properly validate untrusted data during deserialization processes. This allows an unauthenticated attacker to inject malicious PHP objects, which can lead to remote code execution or other severe impacts on the WordPress environment.

PHP Object Injection is a high-severity vulnerability that often results in complete site takeover. With a CVSS score of 9.8, this flaw allows attackers to bypass standard security controls, access sensitive database information, or inject malicious content into the website, leading to significant reputational and operational damage.

Immediate Action: Since a specific patch version is not currently identified in the provided data, administrators should disable the ACPT (Pro) plugin immediately if it is not business-critical.

Proactive Monitoring: Review web server logs for suspicious POST requests containing serialized PHP objects or unexpected input patterns targeting the plugin.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block serialized PHP objects to provide virtual patching until an official update is released.

Public Exploit Available: No (exploit_available: false).

Due to the critical severity and the lack of a defined patch in the provided data, users of ACPT (Pro) should exercise extreme caution. Organizations are advised to deactivate the plugin until the vendor releases a secure version and to monitor for any signs of unauthorized access to their WordPress instance.