PT-2025-47263 · WordPress · Acf Flexible Layouts Manager

Ahmad Salem · Published 2025-11-18 · Updated 2025-11-18 · CVE-2025-12937

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions ACF Flexible Layouts Manager plugin for WordPress versions up to and including 1.1.6

Description The ACF Flexible Layouts Manager plugin for WordPress has a flaw that allows unauthorized modification of data. This is due to a missing capability check within the acf flm update template with pasted layout() function. This allows unauthenticated attackers to update custom field values on individual posts and pages.

Recommendations Update the ACF Flexible Layouts Manager plugin to a version later than 1.1.6.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-12937

Affected Products

Acf Flexible Layouts Manager

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2025-12937 · Security Note
• https://twitter.com/CVEnew/status/1990703894536872316 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/915cce97-8305-4249-b2d3-c4da2f59a95a?source=cve · Note
• https://plugins.trac.wordpress.org/browser/acf-flexible-layouts-manager/trunk/includes/ajax/ajax-paste.php#L4 · Note