An authenticated SQL injection vulnerability in the ACPT (Pro) plugin for WordPress poses a significant risk of unauthorized database data exposure.

This vulnerability is a SQL injection flaw (CWE-89) triggered by improper sanitization of user supplied input. The vulnerability is accessible to any user with subscriber-level authentication or higher.

The ability to perform SQL injection allows an attacker to bypass standard application logic to read sensitive information directly from the WordPress database. Given the CVSS score of 8.5, this high-severity flaw could lead to full database compromise or the exfiltration of sensitive site data, potentially resulting in severe reputational and operational damage.

Immediate Action: Since a specific patch version is currently unconfirmed, administrators should disable or uninstall the ACPT (Pro) plugin until a secure version is released by the vendor.

Proactive Monitoring: Monitor database access logs for unusual query patterns or syntax errors that may indicate automated SQL injection attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets designed to detect and block SQL injection payloads targeting WordPress plugin endpoints.

Public Exploit Available: No (exploit_available: false)

The risk associated with this vulnerability is high, particularly for organizations that rely on the ACPT plugin for managing custom post types. Because the flaw allows authenticated users to manipulate database operations, immediate removal or restriction of the plugin is necessary to protect the integrity of the WordPress environment. Administrators should monitor the vendor's official security advisories for the release of a patched version.