CVE-2026-4812

216.73.217.22

· Published 15/04/2026 04:17 · Modified 15/04/2026 04:17

Labels: CVE-2026-4812 2026-04-15 CVE-2026-4812 CWE-862 [email protected]

Essential information

Published: 15/04/2026 04:17
Modified: 15/04/2026 04:17
Author: —
Creator: —
CVSS: 5.3 MEDIUM (v3.1)
CISA KEV: No
CWE: —
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CVSS metrics

Description

The Advanced Custom Fields (ACF) plugin for WordPress is vulnerable to Missing Authorization to Arbitrary Post/Page Disclosure in versions up to and including 6.7.0. This is due to AJAX field query endpoints accepting user-supplied filter parameters that override field-configured restrictions without proper authorization checks. This makes it possible for unauthenticated attackers with access to a frontend ACF form to enumerate and disclose information about draft/private posts, restricted post types, and other data that should be restricted by field configuration.

NVD status

Status: Received — CVE has been recently published to the CVE List and has been received by the NVD.
Source: [email protected]
NVD: View on NVD

Affected products (CPE)

Product	CPE
wordpress / advanced custom fields	`cpe:2.3:a:wordpress:advanced_custom_fields::::::wordpress::*`