CVE-2026-4812

Description

The Advanced Custom Fields (ACF) plugin for WordPress is vulnerable to Missing Authorization to Arbitrary Post/Page Disclosure in versions up to and including 6.7.0. This is due to AJAX field query endpoints accepting user-supplied filter parameters that override field-configured restrictions without proper authorization checks. This makes it possible for unauthenticated attackers with access to a frontend ACF form to enumerate and disclose information about draft/private posts, restricted post types, and other data that should be restricted by field configuration.

PUBLISHED Reserved 2026-03-25 | Published 2026-04-15 | Updated 2026-04-15 | Assigner Wordfence

Problem types

CWE-862 Missing Authorization

Product status

Timeline

Credits

Fernando Mecozzi finder

References

www.wordfence.com/...-a1a3-411a-b88c-f1cb2aa8d5eb?source=cve

plugins.trac.wordpress.org/...lass-acf-field-post_object.php

plugins.trac.wordpress.org/...lass-acf-field-post_object.php

plugins.trac.wordpress.org/...ass-acf-field-relationship.php

plugins.trac.wordpress.org/...ass-acf-field-relationship.php

plugins.trac.wordpress.org/...ass-acf-field-relationship.php

plugins.trac.wordpress.org/...ass-acf-field-relationship.php

plugins.trac.wordpress.org/...ass-acf-field-relationship.php

plugins.trac.wordpress.org/...ass-acf-field-relationship.php

plugins.trac.wordpress.org/.../class-acf-field-page_link.php

plugins.trac.wordpress.org/.../class-acf-field-page_link.php

plugins.trac.wordpress.org/...ields/class-acf-field-user.php

plugins.trac.wordpress.org/...ields/class-acf-field-user.php

plugins.trac.wordpress.org/...lass-acf-field-post_object.php

plugins.trac.wordpress.org/...lass-acf-field-post_object.php

plugins.trac.wordpress.org/...ass-acf-field-relationship.php

plugins.trac.wordpress.org/...ass-acf-field-relationship.php

cve.org (CVE-2026-4812)

nvd.nist.gov (CVE-2026-4812)

Download JSON