The Advanced Custom Fields (ACF) plugin allows AJAX field query endpoints to accept user-supplied parameters that bypass the field’s configured access restrictions, resulting in arbitrary disclosure of draft or private posts, restricted post types, and other protected data. This missing authorization flaw is classified as CWE‑862 and enables attackers to gather information that should be inaccessible to unauthenticated users.

WordPress sites running the Advanced Custom Fields (ACF®) plugin version 6.7.0 or earlier, distributed by wpengine. The vulnerability affects all field types that expose AJAX query parameters such as page_link, post_object, relationship, and user.

With a CVSS score of 5.3, the flaw presents a moderate severity risk. No EPSS score is publicly available, and the vulnerability is not listed in the CISA KEV catalog, indicating that large-scale exploitation has not yet been observed. The likely attack path is an unauthenticated attacker targeting a publicly accessible front‑end ACF form, sending crafted AJAX requests to enumerate drafts and private content. Because no exploitation checks silently succeed, the vulnerability can be exercised without elevated privileges or prior user authentication.