The ACF to REST API plugin for WordPress suffers from an insecure direct object reference that allows any authenticated user with Contributor or higher privileges to modify Advanced Custom Fields on posts they do not own, user accounts, comments, taxonomy terms, and global options through REST API endpoints. This vulnerability is a classic example of CWE-639, where insufficient object‑level permission checks are performed.

The vulnerability affects the ACF to REST API plugin for WordPress, specifically all releases up to and including version 3.3.4. Any WordPress installation that has this plugin installed and is accessible to authenticated contributors or higher roles is impacted.

With a CVSS score of 4.3 the risk is considered medium and the EPSS score of less than 1% indicates a very low yet non‑zero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to authenticate to the site and then send requests to the endpoints /wp-json/acf/v3/{type}/{id}. Successful exploitation allows the attacker to alter content and configuration without owning the items, leading to unauthorized data modification and potential privilege escalation.