CVE-2026-12428: Blocks for ACF Fields REST API Data Exposure in WordPress

Technical summary

CVE-2026-12428 is an authorization bypass vulnerability in the Blocks for ACF Fields WordPress plugin (versions ≤1.6.2) affecting the /wp-json/acf-field-blocks/v1/values REST endpoint. The get_all_values() function's permission_callback validates only the generic publish_posts capability without object-level authorization checks. A user-supplied id parameter is passed directly to get_field_objects() without verifying the requesting user has permission to access the target object's ACF fields. This enables authenticated attackers at Author level or above to enumerate and retrieve field data from arbitrary posts, private content, and other ACF-supported objects.

Business impact

This vulnerability creates data exposure risk for any WordPress installation using Blocks for ACF Fields to manage sensitive information in custom post types or private content. Authors and contributors can exfiltrate confidential data meant for other users or internal workflows. Organizations relying on ACF for client data, medical records, financial details, or other protected fields face compliance and privacy violations. The impact scales with the sensitivity of ACF field content; installations storing PII or regulated data are at higher risk.

Affected systems

Blocks for ACF Fields plugin for WordPress in versions 1.6.2 and earlier. The vulnerability requires WordPress sites with the plugin active and at least one user account at Author level or above. Sites without Author+ user accounts or those not using the vulnerable REST endpoint are at lower practical risk, though the gap remains present.

Exploitability

Exploitation requires valid WordPress credentials at Author level minimum; unauthenticated users cannot exploit this. However, Author and Contributor accounts are commonly issued to content creators and external partners, widening the attacker surface. No complex exploitation techniques are needed—an authenticated attacker simply crafts REST requests with arbitrary post IDs. The attack is low-friction and leaves minimal traces if proper logging is not enabled. Overall exploitability is moderate given the authentication barrier but high given the ease of execution post-authentication.

Remediation

Update the Blocks for ACF Fields plugin to a patched version that implements object-level capability checks. When updating, verify against the vendor's official advisory that the fix validates the requesting user's permission to access each specific post or object before returning its ACF field data. After patching, audit user permissions and review REST API access logs for suspicious field data requests.

Patch guidance

Verify the current version of Blocks for ACF Fields in your WordPress plugin dashboard (Plugins > Installed Plugins). If the version is 1.6.2 or earlier, prioritize an update. Check the plugin's official repository or vendor advisory for the patched version number and apply it as soon as testing confirms compatibility with your other plugins and theme. Ensure you have a backup before patching production environments. After update, confirm the version number reflects the patch via the same dashboard interface.

Detection guidance

Monitor WordPress REST API logs for repeated requests to /wp-json/acf-field-blocks/v1/values with varying id parameters, especially from low-privilege user accounts (Authors/Contributors). Audit ACF field access and check for unusual cross-post or cross-user data queries. Review server access logs for POST/GET requests to that endpoint from internal IP ranges or specific user agents. If possible, enable WordPress security logging plugins that track REST API usage by user role and endpoint. Look for patterns where a single user requests field data from posts they do not own.

Why prioritize this

Despite a CVSS score of 6.5 (Medium), prioritize this vulnerability for organizations storing sensitive data in ACF fields. The barrier to exploitation is low (authenticated access only), and the impact—direct access to private or protected content—is material. Author accounts are frequently distributed, making this exploitable by a broad set of users. While not in the CISA KEV catalog, the straightforward attack path and data exposure risk justify expedited patching, especially for regulated environments.

Risk score, explained

CVSS 6.5 reflects a network-accessible REST endpoint (AV:N), low attack complexity (AC:L), and the requirement for authenticated access (PR:L). The vector emphasizes confidentiality impact (C:H) with no integrity or availability damage. The score is appropriate for a direct information disclosure vulnerability but does not account for the widespread distribution of Author-level credentials in typical WordPress environments or the sensitivity of ACF-managed data. Organizations storing regulated or highly sensitive information should weight their risk higher than the base score suggests.

Frequently asked questions