What is the CVSS score of CVE-2026-12428?

CVE-2026-12428 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Blocks for ACF Fields CVE-2026-12428

EUVD-2026-42568 MEDIUM

Missing Authorization (CWE-862)

2026-07-09 Wordfence

GHSA-8mgm-62qj-rh6h

WordPress Authentication Bypass Wordpress Plugin Blocks For Acf Fields Display Custom Fields In The Block Editor

6.5

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Network-accessible REST API requires Author-level authentication (PR:L); IDOR discloses confidential post content with no integrity or availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 09, 2026 - 12:12 vuln.today

CVE Published

Jul 09, 2026 - 09:31 nvd

MEDIUM 6.5

DescriptionCVE.org

The Blocks for ACF Fields plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the get_all_values() function in the /wp-json/acf-field-blocks/v1/values REST endpoint in versions up to, and including, 1.6.2. The permission_callback only verifies the generic publish_posts capability and the handler passes a user-supplied id parameter directly to get_field_objects() without verifying that the requesting user is authorized to read the target object. This makes it possible for authenticated attackers, with Author-level access and above, to read ACF field values from arbitrary posts (including private posts, drafts, posts by other users, and other ACF-supported objects) that they should not have access to.

AnalysisAI

Unauthorized data disclosure in the Blocks for ACF Fields WordPress plugin (versions up to and including 1.6.2) allows any authenticated user holding the Author role or above to read ACF field values from arbitrary WordPress objects - including private posts, drafts, and posts owned by other users - via an insecure REST API endpoint. The flaw stems from the REST handler accepting a user-supplied post ID and passing it directly to get_field_objects() without verifying whether the requester holds read permission on that specific object, a classic object-level authorization failure (CWE-862). Reported by Wordfence; no CISA KEV listing and no standalone public exploit code identified at time of analysis, though exploitation is operationally trivial for any attacker with a valid Author-level WordPress account.

Technical ContextAI

The vulnerability resides in the plugin's REST API implementation at /inc/class-rest.php (confirmed via Trac source references at L100, L296, and L302 across plugin tags 1.5.0 and 1.6.0). The /wp-json/acf-field-blocks/v1/values endpoint registers get_all_values() as its handler with a permission_callback that validates only the publish_posts WordPress capability - the minimum required for the Author role - but performs no object-level authorization check. The handler then passes the caller-supplied id parameter directly to ACF's get_field_objects() function, which retrieves field data for whatever post or object ID is provided, regardless of access controls on that object. This is a textbook Insecure Direct Object Reference (IDOR) pattern classified under CWE-862 (Missing Authorization). The affected CPE is cpe:2.3:a:gamaup:blocks_for_acf_fields_-_display_custom_fields_in_the_block_editor:*:*:*:*:*:*:*:*. Advanced Custom Fields (ACF) is a widely-adopted WordPress extension that attaches structured custom field data to posts; this plugin bridges that data to the Gutenberg block editor via REST, making the exposed endpoint part of normal editorial workflows.

RemediationAI

Update the Blocks for ACF Fields plugin to a version beyond 1.6.2 as soon as a patched release is available in the WordPress plugin directory; a remediation changeset has been committed to the plugin's SVN repository (https://plugins.trac.wordpress.org/changeset?reponame=&old=3587876%40acf-field-blocks&new=3587876%40acf-field-blocks), but a specific patched release version number is not independently confirmed from available data - monitor the WordPress.org plugin page for a version update. As a compensating control while awaiting the patch, administrators should restrict access to the /wp-json/acf-field-blocks/v1/values REST endpoint at the web-server level using nginx location-deny rules or Apache RewriteRules targeting that path; be aware this will break any Gutenberg block functionality that relies on the endpoint to render ACF field data in the editor. Alternatively, a WordPress security plugin capable of REST API endpoint filtering (e.g., Wordfence, Solid Security) can block the specific route without a full REST API disable. Reducing the number of accounts with Author-level access or above limits the attacker pool. If ACF fields on your installation contain PII, financial data, or confidential draft content, treat remediation as high priority regardless of the Medium CVSS score.