Font Awesome Field CVE-2026-66678

Exploitation requires the Advanced Custom Fields: Font Awesome Field plugin version 6.1.1 or earlier to be installed and active on a WordPress site. The CVSS vector (PR:L) confirms the attacker must hold at minimum a Contributor-level WordPress account on the target installation - anonymous unauthenticated access is insufficient. Sites that restrict contributor registration to trusted users significantly reduce external exposure. The impact is limited to confidentiality (C:L); no integrity or availability impact is possible based on the CVSS vector, meaning the attacker cannot modify data or disrupt service through this flaw alone.

The CVSS 3.1 score of 4.3 (Medium) is consistent with the available signals: network reachable (AV:N), low complexity (AC:L), low privilege required (PR:L), no user interaction (UI:N), unchanged scope (S:U), and only confidentiality impact at low severity (C:L/I:N/A:N). The real-world risk is limited by two significant factors: an attacker must already hold a Contributor-level (or higher) WordPress account on the target site, and the impact ceiling is low-level data read with no integrity or availability consequence. No EPSS score was provided in the input data, so exploitation probability cannot be quantified. Neither a public POC nor a CISA KEV listing is present, suggesting this has not been broadly weaponized. For most sites, the practical threat is restricted to insider risk or sites with open user registration allowing contributor self-registration. The Patchstack report and EUVD listing confirm the vulnerability is real, but organizational priority should be moderate unless open registration exposes the contributor role to untrusted parties.

An attacker who has registered or obtained a Contributor-level account on a WordPress site running the affected plugin sends a crafted network request to the plugin's unprotected endpoint, bypassing the missing authorization check to read confidential field data or invoke restricted functionality. Because no public proof-of-concept has been identified at time of analysis, active exploitation likely requires reverse-engineering the plugin code to identify the unguarded handler. The low attack complexity (AC:L) suggests that once the vulnerable endpoint is known, exploitation is straightforward.