CVE-2026-32563

The Custom Post Types Plugin for WordPress versions up to 2.0.63 is vulnerable to a PHP Object Injection flaw that allows unauthenticated attackers to execute arbitrary PHP code. This critical vulnerability poses a significant risk of remote code execution, potentially compromising the integrity and availability of affected WordPress sites. WordPress administrators and developers using this plugin should prioritize immediate updates to mitigate the risk.