CVE-2026-12428

Name of the Vulnerable Software and Affected Versions Blocks for ACF Fields versions prior to 1.6.3

Description An issue exists where authenticated users with Author-level access and above can gain unauthorized access to data. This occurs because the get all values() function in the '/wp-json/acf-field-blocks/v1/values' REST endpoint lacks a proper capability check. While the permission callback verifies the publish posts capability, the handler passes a user-supplied id parameter directly to get field objects() without confirming if the user is authorized to read the target object. Consequently, attackers can read ACF field values from arbitrary posts, including drafts, private posts, and posts created by other users.

Recommendations Update to a version newer than 1.6.2. Restrict access to the '/wp-json/acf-field-blocks/v1/values' REST endpoint to minimize the risk of exploitation.