What is the CVSS score of CVE-2026-4812?

CVE-2026-4812 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

WordPress CVE-2026-4812

EUVD-2026-22828 MEDIUM

Missing Authorization (CWE-862)

2026-04-15 Wordfence

Authentication Bypass WordPress Advanced Custom Fields

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 15, 2026 - 01:48 vuln.today

EUVD ID Assigned

Apr 15, 2026 - 01:45 euvd

EUVD-2026-22828

Analysis Generated

Apr 15, 2026 - 01:45 vuln.today

CVE Published

Apr 15, 2026 - 01:25 nvd

MEDIUM 5.3

DescriptionCVE.org

The Advanced Custom Fields (ACF) plugin for WordPress is vulnerable to Missing Authorization to Arbitrary Post/Page Disclosure in versions up to and including 6.7.0. This is due to AJAX field query endpoints accepting user-supplied filter parameters that override field-configured restrictions without proper authorization checks. This makes it possible for unauthenticated attackers with access to a frontend ACF form to enumerate and disclose information about draft/private posts, restricted post types, and other data that should be restricted by field configuration.

AnalysisAI

Unauthenticated attackers can bypass field-level authorization in Advanced Custom Fields (ACF) plugin versions up to 6.7.0 via AJAX endpoints that process user-supplied filter parameters without proper privilege checks, enabling disclosure of draft, private, and restricted post/page content that should be hidden by field configuration. The vulnerability affects any WordPress site with ACF installed and frontend forms exposed, requiring only network access and no user interaction. CVSS 5.3 reflects confidentiality impact with low attack complexity; no KEV status or public POC confirmed at analysis time.

Technical ContextAI

Advanced Custom Fields is a WordPress plugin that extends post metadata management through custom field definitions. The vulnerability exists in AJAX field query endpoints (post_object, relationship, page_link, and user field types) that construct database queries to populate field selections. These endpoints accept user-supplied filter parameters (such as post type, status, or search constraints) that are merged into or override the field's configured restrictions without verifying the requesting user has authorization to access the resulting posts. The root cause is CWE-862 (Missing Authorization), where authorization decisions that should occur before data retrieval are either absent or applied inconsistently. The affected code paths in class-acf-field-post_object.php, class-acf-field-relationship.php, class-acf-field-page_link.php, and class-acf-field-user.php perform database queries based on $_POST or $_REQUEST parameters without sanitizing or validating against field-level access policies.

RemediationAI

Update Advanced Custom Fields to a patched version released after 6.7.0. WordPress site administrators should navigate to Plugins > Installed Plugins, locate Advanced Custom Fields, and click Update if available. If a patched version is not yet released, implement temporary mitigation by disabling frontend ACF forms that expose post_object, relationship, page_link, or user fields until a patch is available, or restrict form access to authenticated users only via authentication guards in the form template or access control plugins. Consult the Wordfence vulnerability advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/51e3a976-a1a3-411a-b88c-f1cb2aa8d5eb?source=cve) for the exact patched version number and any additional mitigation guidance from WP Engine or the ACF development team.