PT-2026-33003 · WordPress · Advanced Custom Fields Pro

Fernando Mecozzi · Published 2026-04-15 · Updated 2026-04-24 · CVE-2026-4812

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Advanced Custom Fields (ACF) plugin for WordPress versions prior to 6.7.1

Description The plugin contains a flaw where AJAX field query endpoints accept user-supplied filter parameters that override field-configured restrictions without proper authorization checks. This allows unauthenticated attackers with access to a frontend ACF form to enumerate and disclose information regarding draft or private posts, restricted post types, and other data intended to be restricted by field configuration.

Recommendations Update the plugin to a version later than 6.7.0.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-4812

Affected Products

Advanced Custom Fields Pro

References · 20

• https://nvd.nist.gov/vuln/detail/CVE-2026-4812 · Security Note
• https://plugins.trac.wordpress.org/browser/advanced-custom-fields/tags/6.7.0/includes/fields/class-acf-field-page_link.php#L144 · Note
• https://plugins.trac.wordpress.org/browser/advanced-custom-fields/tags/6.7.0/includes/fields/class-acf-field-relationship.php#L187 · Note
• https://plugins.trac.wordpress.org/browser/advanced-custom-fields/trunk/includes/fields/class-acf-field-relationship.php#L187 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/51e3a976-a1a3-411a-b88c-f1cb2aa8d5eb?source=cve · Note
• https://plugins.trac.wordpress.org/browser/advanced-custom-fields/tags/6.7.0/includes/fields/class-acf-field-relationship.php#L180 · Note
• https://reddit.com/r/StopBadBots/comments/1su8zi6/action_required_2_million_acf_users_urged_to_scan · Reddit Post
• https://plugins.trac.wordpress.org/browser/advanced-custom-fields/trunk/includes/fields/class-acf-field-post_object.php#L92 · Note
• https://plugins.trac.wordpress.org/browser/advanced-custom-fields/trunk/includes/fields/class-acf-field-user.php#L435 · Note
• https://plugins.trac.wordpress.org/browser/advanced-custom-fields/trunk/includes/fields/class-acf-field-page_link.php#L144 · Note
• https://plugins.trac.wordpress.org/browser/advanced-custom-fields/tags/6.7.0/includes/fields/class-acf-field-relationship.php#L171 · Note
• https://plugins.trac.wordpress.org/browser/advanced-custom-fields/tags/6.7.0/includes/fields/class-acf-field-relationship.php#L118 · Note
• https://twitter.com/CVEnew/status/2044338853176385901 · Twitter Post
• https://plugins.trac.wordpress.org/browser/advanced-custom-fields/trunk/includes/fields/class-acf-field-relationship.php#L180 · Note
• https://plugins.trac.wordpress.org/browser/advanced-custom-fields/tags/6.7.0/includes/fields/class-acf-field-post_object.php#L92 · Note