Missing Authorization in Advanced Custom Fields Plugin for WordPress

CVE-2026-4812

What is CVE-2026-4812?

The Advanced Custom Fields (ACF) plugin for WordPress contains a vulnerability that allows unauthenticated users to access sensitive data. Specifically, the AJAX field query endpoints do not enforce proper authorization checks when handling user-supplied filter parameters. As a result, attackers exploiting this flaw can potentially enumerate and disclose confidential information from draft and private posts, as well as other restricted post types safely guarded by field configuration. This makes it critical for site administrators to ensure they are using the latest versions of the ACF plugin and applying any relevant patches.

References