The vulnerability in the Advanced Custom Fields WordPress plugin allows an attacker to alter the title and content of any post that is exposed through a publicly accessible acf_form() instance. By submitting crafted values for the _post_title and _post_content parameters in a form request, an unauthenticated user can override the original post data. This leads to data tampering, defacement, or injection of malicious content, compromising the integrity of the site’s content. The weakness is an authentication bypass (CWE‑862).

WordPress sites that have the Advanced Custom Fields plugin installed in versions 6.8.1 or earlier are affected. Sites using the plugin instance acf_form() that is publicly exposed (e.g., contact or custom forms) are at risk. The vulnerability applies to all installations of the plugin regardless of user role or permissions.

The CVSS score is 5.3, indicating moderate severity. The EPSS score is not available, so the current exploitation probability is unknown, and the issue is not in the CISA KEV catalog. The likely attack vector is via an unauthenticated HTTP POST to the plugin’s front‑end form handler, requiring no special credentials or advanced skills. Once exploited, the attacker can modify posts site‑wide, making it a moderate risk to data integrity and site trustworthiness.