What is the CVSS score of CVE-2026-66678?

CVE-2026-66678 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Font Awesome Field CVE-2026-66678

EUVD-2026-53892 MEDIUM

Missing Authorization (CWE-862)

2026-08-06 Patchstack

GHSA-86cg-5348-hfwg

WordPress Authentication Bypass Advanced Custom Fields Wordpress Plugin

4.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Requires contributor-level WordPress account (PR:L); impact is read-only data exposure (C:L) with no integrity or availability consequence, consistent with a missing authorization check on a data-retrieval endpoint.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 16:13 vuln.today

DescriptionCVE.org

Contributor Broken Access Control in Advanced Custom Fields: Font Awesome Field <= 6.1.1 versions.

AnalysisAI

Broken access control in the Advanced Custom Fields: Font Awesome Field WordPress plugin (versions up to and including 6.1.1) permits contributor-level authenticated users to perform privileged operations beyond their intended role. The CWE-862 root cause indicates the plugin fails to enforce proper authorization checks before executing certain functionality, allowing lower-privileged users to read data or invoke actions restricted to higher roles. No public exploit code or CISA KEV listing has been identified at time of analysis, but the network-accessible attack vector and low privilege requirement make this exploitable by any user with a contributor account on affected WordPress installations.

Technical ContextAI

The Advanced Custom Fields: Font Awesome Field plugin (CPE: cpe:2.3:a:justin_kruit:advanced_custom_fields:_font_awesome_field:*:*:*:*:*:*:*:*) extends the popular Advanced Custom Fields (ACF) framework for WordPress by adding a Font Awesome icon picker field type. CWE-862 (Missing Authorization) describes a failure to verify that the authenticated user possesses sufficient permissions before granting access to a resource or operation - in the WordPress context this typically manifests as AJAX handlers or REST endpoints that check only for authentication (is_user_logged_in or nonce verification) without confirming the user's role or capability (e.g., missing current_user_can() checks). The CVSS vector AV:N/PR:L confirms exploitation occurs over the network by a user with low-privilege credentials, which in WordPress maps to the Contributor role - the lowest level that can create draft content.

RemediationAI

Update the Advanced Custom Fields: Font Awesome Field plugin to a version beyond 6.1.1 once a patched release is published by the vendor. No confirmed fixed version number was present in the available input data - the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/advanced-custom-fields-font-awesome/vulnerability/wordpress-advanced-custom-fields-font-awesome-field-plugin-6-1-1-broken-access-control-vulnerability should be monitored for a confirmed patch version. As an immediate compensating control, site administrators should audit whether open user registration allows untrusted parties to self-register as Contributors; if so, disabling open registration or requiring manual role approval eliminates the external attack surface entirely. Removing the plugin temporarily is a disruptive but effective workaround if contributor accounts are held by untrusted users and no patch is yet available. Note that restricting contributor capabilities site-wide may affect legitimate content workflows.