Advanced Custom Fields: Font Awesome CVE-2026-6415

Authenticated access as a WordPress user with Subscriber-level permission or higher is required. The attacker must have direct or indirect access to edit or create posts/pages containing ACF Font Awesome custom fields. The plugin must be installed and activated on the WordPress site. The Font Awesome field type must be configured in at least one ACF field group. Client-side JavaScript execution must be enabled in the victim's browser (standard for WordPress admin and front-end). Non-default configurations that restrict Subscriber access to ACF fields or that disable JavaScript would reduce exploitability, but default WordPress configurations and common ACF setups do not include these restrictions. The vulnerability does NOT require admin privileges, site misconfiguration, or user interaction beyond normal page viewing by victims.

CVSS 6.4 (Medium) with network vector, low complexity, and low privilege requirements indicates a realistic attack surface. The Subscriber-level authentication requirement significantly reduces raw exploitability compared to unauthenticated XSS, but WordPress sites commonly allow self-registration or have weak user onboarding policies, making Subscriber accounts obtainable. The scope change (C=C) reflects potential cross-user impact when stored XSS affects page rendering for all site visitors. EPSS data is not provided, preventing quantification of exploitation probability in the wild. No KEV status or POC availability is indicated in the provided data. The primary real-world constraint is authentication - an attacker must first establish a WordPress account (self-registered or compromised), then craft a malicious JSON field value. Once injected, the vulnerability is persistent and affects all users visiting the contaminated page. This is a genuine priority for WordPress administrators managing plugins with user-generated content or community contributions, particularly if ACF is used in customer-facing forms or user-editable pages.

A threat actor registers a free Subscriber account on a vulnerable WordPress site running ACF Font Awesome 5.0.2. The attacker navigates to a page or post using an ACF Font Awesome custom field and injects malicious JavaScript via the field's JSON input (e.g., by editing the raw field value in browser developer tools or via direct database manipulation if combined with another vulnerability). When site administrators or other users visit the page, the injected script executes in their browsers with the privileges of the page owner, enabling credential theft, malware distribution, or defacement.