EUVD-2026-22828Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconDiscover frontend ACF form
-
DeliveryIdentify AJAX endpoint URL
-
ExploitCraft POST request with filter override parameters
-
InstallSubmit request without authentication
-
C2Receive unfiltered post/page results
-
ExecuteExtract metadata and sensitive content
-
ImpactRepeat to enumerate all restricted data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | CVSS 5.3 indicates low to moderate severity with network-accessible attack vector, low complexity, and no authentication required-all favorable conditions for attacker. However, EPSS and exploitation telemetry are unavailable, limiting prediction of real-world abuse. The lack of confirmed KEV status and public POC suggests this is not yet actively exploited at scale, though the simplicity of the attack (fuzzing AJAX endpoints with filter overrides) and the ubiquity of ACF in WordPress ecosystems (used on millions of sites) present significant exposure. The confidentiality impact is limited (C:L per CVSS), but in practice, information disclosure of draft posts, pending user submissions, or restricted content types can expose sensitive business logic, PII, or unreleased content-contextual severity may exceed the numerical score depending on site content. Integrity and availability are not impacted (I:N, A:N). This is a real priority for ACF users publishing content with access restrictions, but lower urgency than remote code execution vulnerabilities; patching should align with scheduled maintenance windows rather than emergency response. |
| Exploit ScenarioDerived | An unauthenticated attacker discovers a WordPress site with a frontend ACF form containing a relationship or post_object field configured to restrict results to published posts only. The attacker intercepts or directly crafts POST requests to the ACF AJAX endpoints (e.g., admin-ajax.php?action=acf/fields/post_object/query), adding filter parameters that override the field configuration to include post_status=draft and post_status=private. The endpoint processes the request without re-validating the user's authorization against these alternative statuses and returns metadata for draft and private posts that would otherwise remain hidden. The attacker repeats this with varying filters to enumerate all accessible content, compiling a list of unreleased articles, pending approvals, or restricted data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 15, 2026
Unauthenticated attackers can bypass field-level authorization in Advanced Custom Fields (ACF) plugin versions up to 6.7.0 via AJAX endpoints that process user-supplied filter parameters without proper privilege checks, enabling disclosure of draft, private, and restricted post/page content that should be hidden by field configuration. The vulnerability affects any WordPress site with ACF installed and frontend forms exposed, requiring only network access and no user interaction. CVSS 5.3 reflects confidentiality impact with low attack complexity; no KEV status or public POC confirmed at analysis time.
RemediationAI
Update Advanced Custom Fields to a patched version released after 6.7.0. WordPress site administrators should navigate to Plugins > Installed Plugins, locate Advanced Custom Fields, and click Update if available. If a patched version is not yet released, implement temporary mitigation by disabling frontend ACF forms that expose post_object, relationship, page_link, or user fields until a patch is available, or restrict form access to authenticated users only via authentication guards in the form template or access control plugins. Consult the Wordfence vulnerability advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/51e3a976-a1a3-411a-b88c-f1cb2aa8d5eb?source=cve) for the exact patched version number and any additional mitigation guidance from WP Engine or the ACF development team.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Advanced Custom Fields is a WordPress plugin that extends post metadata management through custom field definitions. The vulnerability exists in AJAX field query endpoints (post_object, relationship, page_link, and user field types) that construct database queries to populate field selections. These endpoints accept user-supplied filter parameters (such as post type, status, or search constraints) that are merged into or override the field's configured restrictions without verifying the requesting user has authorization to access the resulting posts. The root cause is CWE-862 (Missing Authorization), where authorization decisions that should occur before data retrieval are either absent or applied inconsistently. The affected code paths in class-acf-field-post_object.php, class-acf-field-relationship.php, class-acf-field-page_link.php, and class-acf-field-user.php perform database queries based on $_POST or $_REQUEST parameters without sanitizing or validating against field-level access policies.
Know when Advanced Custom Fields Acf gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
The Advanced Custom Fields (ACF) plugin for WordPress is vulnerable to Missing Authorization to Arbitrary Post/Page Disclosure in versions up to and including 6.7.0. This is due to AJAX field query endpoints accepting user-supplied filter parameters that override field-configured restrictions without proper authorization checks. This makes it possible for unauthenticated attackers with access to a frontend ACF form to enumerate and disclose information about draft/private posts, restricted post types, and other data that should be restricted by field configuration.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
GitHub PoC
Exploit-DB