CVE-2026-66678: WordPress Advanced Custom Fields: Font Awesome Field plugin <= 6.1.1 - Broken Access Control vulnerability

Published Aug 6, 2026

Updated

Contributor Broken Access Control in Advanced Custom Fields: Font Awesome Field <= 6.1.1 versions.

Affected Software

2 affected components

WordPress Advanced Custom Fields: Font Awesome Field<=6.1.1

WordPress/Advanced Custom Fields: Font Awesome Field<=6.1.1

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress Advanced Custom Fields: Font Awesome Field plugin to a version that resolves this vulnerability.
Fixed in 6.1.1

Aug 6, 2026

CVE Published

via MITRE·02:27 PM

Data Sourced

via MITRE·02:27 PM

DescriptionSeverityWeakness

The severity of CVE-2026-66678 is medium with a score of 4.3.

To fix CVE-2026-66678, upgrade the Advanced Custom Fields: Font Awesome Field plugin to version 6.1.2 or later.

CVE-2026-66678 is a Broken Access Control vulnerability.

CVE-2026-66678 affects the Advanced Custom Fields: Font Awesome Field plugin versions 6.1.1 and earlier.

CVE-2026-66678 may allow unauthorized access to certain features or data due to insufficient access controls.