CVE-2024-31366 - WordPress Post Type Builder (PTB) plugin <= 2.0.8 - Auth. Arbitrary Post/Page Creation vulnerability

HIGH

WordPress Post Type Builder (PTB) plugin <= 2.0.8 - Auth. Arbitrary Post/Page Creation vulnerability

Published Apr 9, 2024

7.1

HIGH

CVSS 3.1

EPSS 0.49%

Missing Authorization vulnerability in Themify Post Type Builder (PTB).This issue affects Post Type Builder (PTB): from n/a through 2.0.8.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

unaffected

Version	Status	Constraints
-	affected	<=2.0.8

No remediation recorded yet.

0.49% 0.00493

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 4, 2026.

EPSS probability 0.00493

2024-2026

Table of values (9 key points)

Flat stretches are collapsed. Showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 4, 2026	0.49% (0.00493)	40.17th	v5 (v2026.06.15)
Jun 15, 2026	0.49% (0.00493)	38.22th	v5 (v2026.06.15)
Mar 30, 2025	0.19% (0.00192)	38.15th	v4 (v2025.03.14)
Mar 29, 2025	8.07% (0.08066)	86.62th	v4 (v2025.03.14)
Mar 24, 2025	0.19% (0.00192)	38.20th	v4 (v2025.03.14)
Mar 23, 2025	2.35% (0.02346)	81.84th	v4 (v2025.03.14)
Mar 17, 2025	0.19% (0.00192)	39.02th	v4 (v2025.03.14)
Dec 12, 2024	0.04% (0.00043)	10.81th	v3 (v2023.03.01)
Apr 9, 2024	0.04% (0.00043)	7.76th	v3 (v2023.03.01)

Weaknesses (1)

CWE-862

Missing Authorization

Link	Providers	Tags
https://patchstack.com/database/vulnerability/themify-ptb/wordpress-post-type-builder-ptb-plugin-2-0-8-subscriber-arbitrary-post-page-creation-vulnerability?_s_id=cve		vdb-entry