CVE-2026-12428 PUBLISHED

Blocks for ACF Fields <= 1.6.2 - Missing Authorization to Authenticated (Author+) Arbitrary ACF Field Value Disclosure via 'id' Parameter

Assigner: Wordfence
Reserved: 16.06.2026 Published: 09.07.2026 Updated: 09.07.2026

The Blocks for ACF Fields plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the get_all_values() function in the /wp-json/acf-field-blocks/v1/values REST endpoint in versions up to, and including, 1.6.2. The permission_callback only verifies the generic publish_posts capability and the handler passes a user-supplied id parameter directly to get_field_objects() without verifying that the requesting user is authorized to read the target object. This makes it possible for authenticated attackers, with Author-level access and above, to read ACF field values from arbitrary posts (including private posts, drafts, posts by other users, and other ACF-supported objects) that they should not have access to.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS Score: 6.5

Product Status

Vendor gamaup
Product Blocks for ACF Fields — Display Custom Fields in the Block Editor
Versions Default: unaffected
  • affected from 0 to 1.6.2 (incl.)

Credits

  • thinnawarth mathuros finder

References

Problem Types

  • CWE-862 Missing Authorization CWE