Junglewise Threat Intelligence

CVE-2026-12428: gamaup Blocks for ACF Fields missing authorization in get_all_values

CVE-2026-12428 · Severity: medium · CVSS 6.5 · Published 2026-07-09

Executive brief

The Blocks for ACF Fields plugin for WordPress, which helps display custom data fields within the website editor, contains a security flaw that allows unauthorized data access. Users with basic 'Author' level permissions can bypass security restrictions to view sensitive information from private posts, drafts, and content belonging to other users. This could lead to the exposure of confidential business data or internal site configurations stored in custom fields.

Technical details

The vulnerability is classified as Missing Authorization (CWE-862) within the REST API implementation of the Blocks for ACF Fields plugin. Specifically, the 'get_all_values()' function associated with the '/wp-json/acf-field-blocks/v1/values' endpoint fails to perform adequate permission checks. While the 'permission_callback' verifies a generic 'publish_posts' capability, the handler accepts a user-supplied 'id' parameter and passes it directly to 'get_field_objects()' without validating if the requester has the rights to view that specific object. An authenticated attacker with Author-level privileges can exploit this to retrieve Advanced Custom Fields (ACF) data from arbitrary posts, including private and draft content. The issue is addressed in versions following 1.6.2.

Affected products

  • gamaup Blocks for ACF Fields <= 1.6.2

Timeline

  • 2026-07-09: disclosed
  • 2026-07-09: advisory

References