SQL Injection in WordPress Custom Post Types Plugin

Subscriber SQL Injection in ACPT (Pro) - Custom Post Types Plugin for WordPress <= 2.0.63 versions.

Casky was already ahead

This CVE exploits attack patterns that Casky's 323matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-32564 is a subscriber-level SQL injection vulnerability in the ACPT (Advanced Custom Post Types) Pro plugin for WordPress affecting versions up to 2.0.63. This vulnerability allows authenticated subscribers to execute arbitrary SQL queries against the WordPress database, potentially leading to unauthorized data access, modification, or deletion. The impact is particularly concerning because subscriber accounts are commonly created on WordPress sites for legitimate users, meaning threat actors can exploit this vulnerability with minimal privilege requirements. Organizations running vulnerable versions of this plugin face significant risk of data breaches, credential theft, and lateral movement within their WordPress infrastructure.

Casky's 323 matched security skills leverage Claude AI's extended reasoning to detect exploitation patterns tied to TA0001 (Initial Access) and TA0043 (Reconnaissance). Practitioners will observe detection findings that identify suspicious SQL query patterns in database logs—such as UNION-based injection attempts, time-based blind SQL injection signatures, and abnormal database access from subscriber-level accounts. The platform maps these behavioral indicators directly to CWE-89 SQL injection, correlating them with MITRE ATT&CK techniques that show how adversaries use reconnaissance to discover injectable parameters and initial access to establish persistence. Practitioners reviewing their Casky findings will see granular analysis of HTTP request payloads, database query logs, and access patterns, enabling them to distinguish between legitimate subscriber activity and exploitation attempts with high confidence.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

323 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-32564.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-32564

Casky has 323 skills that investigate the attack patterns behind CVE-2026-32564. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn