Unauthorized Data Modification in ACF Flexible Layouts Manager for WordPress
CVE-2025-12937
6.5MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 18 November 2025
What is CVE-2025-12937?
The ACF Flexible Layouts Manager plugin for WordPress allows for unauthorized data modification due to a lack of capability checks in its 'acf_flm_update_template_with_pasted_layout' function. This vulnerability permits unauthenticated users to alter custom field values on individual posts and pages, potentially compromising the integrity of site content. All versions up to and including 1.1.6 are affected, making it imperative for site administrators to apply appropriate security measures.
Affected Version(s)
ACF Flexible Layouts Manager * <= 1.1.6