PT-2026-33003 · WordPress · Advanced Custom Fields Pro

Fernando Mecozzi · Publicado 2026-04-15 · Atualizado 2026-04-24 · CVE-2026-4812

Positive Technologies (AI Summary) · Pt

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Advanced Custom Fields (ACF) plugin for WordPress versões anteriores a 6.7.1

Description O plugin contém uma falha onde endpoints de consulta de campo AJAX aceitam parâmetros de filtro fornecidos pelo usuário que substituem as restrições configuradas no campo sem as devidas verificações de autorização. Isso permite que invasores não autenticados com acesso a um formulário ACF no frontend enumerem e divulguem informações sobre posts rascunhos ou privados, tipos de posts restritos e outros dados que deveriam ser restringidos pela configuração do campo.

Recommendations Atualize o plugin para uma versão posterior a 6.7.0.

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2026-4812

Produtos afetados

Advanced Custom Fields Pro

Referências · 20

• https://plugins.trac.wordpress.org/browser/advanced-custom-fields/tags/6.7.0/includes/fields/class-acf-field-page_link.php#L144 · Nota
• https://plugins.trac.wordpress.org/browser/advanced-custom-fields/tags/6.7.0/includes/fields/class-acf-field-relationship.php#L187 · Nota
• https://plugins.trac.wordpress.org/browser/advanced-custom-fields/trunk/includes/fields/class-acf-field-relationship.php#L187 · Nota
• https://wordfence.com/threat-intel/vulnerabilities/id/51e3a976-a1a3-411a-b88c-f1cb2aa8d5eb?source=cve · Nota
• https://plugins.trac.wordpress.org/browser/advanced-custom-fields/tags/6.7.0/includes/fields/class-acf-field-relationship.php#L180 · Nota
• https://reddit.com/r/StopBadBots/comments/1su8zi6/action_required_2_million_acf_users_urged_to_scan · Publicação no Reddit
• https://plugins.trac.wordpress.org/browser/advanced-custom-fields/trunk/includes/fields/class-acf-field-post_object.php#L92 · Nota
• https://plugins.trac.wordpress.org/browser/advanced-custom-fields/trunk/includes/fields/class-acf-field-user.php#L435 · Nota
• https://plugins.trac.wordpress.org/browser/advanced-custom-fields/trunk/includes/fields/class-acf-field-page_link.php#L144 · Nota
• https://plugins.trac.wordpress.org/browser/advanced-custom-fields/tags/6.7.0/includes/fields/class-acf-field-relationship.php#L171 · Nota
• https://plugins.trac.wordpress.org/browser/advanced-custom-fields/tags/6.7.0/includes/fields/class-acf-field-relationship.php#L118 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-4812 · Nota de Segurança
• https://twitter.com/CVEnew/status/2044338853176385901 · Publicação no Twitter
• https://plugins.trac.wordpress.org/browser/advanced-custom-fields/trunk/includes/fields/class-acf-field-relationship.php#L180 · Nota
• https://plugins.trac.wordpress.org/browser/advanced-custom-fields/tags/6.7.0/includes/fields/class-acf-field-post_object.php#L92 · Nota