CVE-2026-4812: Advanced Custom Fields (ACF®) <= 6.7.0 - Unauthenticated Missing Authorization to Arbitrary Post/Page Disclosure via AJAX Field Query Parameters
The Advanced Custom Fields (ACF) plugin for WordPress is vulnerable to Missing Authorization to Arbitrary Post/Page Disclosure in versions up to and including 6.7.0. This is due to AJAX field query endpoints accepting user-supplied filter parameters that override field-configured restrictions without proper authorization checks. This makes it possible for unauthenticated attackers with access to a frontend ACF form to enumerate and disclose information about draft/private posts, restricted post types, and other data that should be restricted by field configuration.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-4812?
CVE-2026-4812 has a medium severity rating due to its potential for unauthorized access to posts and pages.
How do I fix CVE-2026-4812?
To fix CVE-2026-4812, update the Advanced Custom Fields plugin to a version later than 6.7.0.
What specific issue does CVE-2026-4812 address?
CVE-2026-4812 addresses a vulnerability in the Advanced Custom Fields plugin that allows unauthenticated users to access arbitrary post and page content.
Which versions are affected by CVE-2026-4812?
CVE-2026-4812 affects versions of Advanced Custom Fields up to and including 6.7.0.
Is there a workaround for CVE-2026-4812?
A potential workaround for CVE-2026-4812 includes restricting access to the plugin’s functionality via user permissions.