The Blocks for ACF Fields plugin contains a missing capability check in its REST API. The get_all_values() handler accepts a user-supplied id parameter and passes it directly to get_field_objects() without ensuring the requesting user can read that post. This flaw allows authenticated users with Author-level or higher permissions to read ACF field values from any post or supported object, including private posts, drafts, or posts owned by other users. The vulnerability, classified as CWE‑862, results in a confidentiality breach but does not provide privilege escalation, remote code execution, or denial of service.

Any WordPress site running Blocks for ACF Fields version 1.6.2 or earlier exposes the vulnerable /wp-json/acf‑field‑blocks/v1/values REST endpoint. Site administrators with these affected releases should verify the plugin version and apply the fix or mitigate the issue as quickly as possible.

The CVSS score of 6.5 indicates a moderate severity. The EPSS score is below 1%, suggesting a low yet nonzero exploitation probability, and the vulnerability is not listed in the CISA KEV catalog, implying it has not yet been widely exploited. Attackers must be authenticated, a common precondition for accessing the WordPress REST API. The exploit path is straightforward: a crafted HTTP request to the REST endpoint with an arbitrary id parameter bypasses the intended capability check and returns the requested field values. The impact is limited to data leakage; there is no remote code execution or privilege escalation.