PT-2026-1585 · WordPress · Wordpress+1

Kai Aizen · Published 2026-01-07 · Updated 2026-01-07 · CVE-2025-12030

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions ACF to REST API plugin for WordPress versions through 3.3.4

Description The ACF to REST API plugin for WordPress is affected by an Insecure Direct Object Reference issue. Insufficient capability checks in the update item permissions check() method allow authenticated attackers with Contributor-level access or higher to modify ACF fields. Attackers can modify posts they do not own, user accounts, comments, taxonomy terms, and global options. This is possible through the /wp-json/acf/v3/{type}/{id} API endpoints, where {type} and {id} represent the object type and identifier, respectively. The issue stems from a lack of object-specific permission checks, only verifying the edit posts capability.

Recommendations Update the ACF to REST API plugin to a version later than 3.3.4.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2025-12030

Affected Products

Acf-To-Rest-Api

Wordpress

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-12030 · Security Note
• https://plugins.trac.wordpress.org/browser/acf-to-rest-api/tags/3.3.4/v3/lib/endpoints/class-acf-to-rest-api-controller.php#L120 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/5ab508fa-298c-48c1-8510-f2e0a881675a?source=cve · Note
• https://twitter.com/CVEnew/status/2008824751809036734 · Twitter Post
• https://plugins.trac.wordpress.org/browser/acf-to-rest-api/tags/3.3.4/v3/lib/endpoints/class-acf-to-rest-api-controller.php#L108 · Note