The Advanced Custom Fields (ACF) plugin before version 6.8.11 does not check read permissions when rendering relational field values. As a result, authenticated users with Contributor or higher capabilities are able to view the titles and internal status of other users' unpublished posts, leaking sensitive content that was intended to remain private. This flaw constitutes an information disclosure that could reveal the existence and column of forthcoming posts, potentially enabling malicious actors to plan attacks or compromise privacy. According to the description, the flaw originates from a missing authorization check during display of relational fields. It does not allow execution of arbitrary code or denial of service.

The vulnerability affects WordPress installations that use any version of the Advanced Custom Fields plugin older than 6.8.11. No specific WordPress core version is listed, so any patch compatible with ACF 6.8.11 or newer should mitigate the issue. The CNA lists Advanced Custom Fields (ACF®) as the affected vendor/product with no further version granularity beyond the cut‑off of 6.8.11.

The exploitation path requires a valid WordPress account with Contributor or higher privileges. Once authenticated, an attacker can trigger the plugin’s rendering logic and read the hidden post details through a standard web request. Because no EPSS data is available and the vulnerability is not listed in the CISA KEV catalog, the current exploitation probability is unknown, but the flaw would be trivial to execute for any user who can submit or edit posts. The impact is primarily confidentiality. The absence of a publicly recognized exploit in CISA catalog reduces immediate threat, yet the potential for sensitive content leakage warrants prompt remediation.