https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T21:23:23.123947+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-291448 EUVD-2026-291448 2026-10-05T21:23:23.176098+00:00 EUVD-2026-291448 https://cve.radiocsirt.org/vuln/fkie_cve-2026-4812 fkie_cve-2026-4812 2026-10-05T21:23:23.176150+00:00

The Advanced Custom Fields (ACF) plugin for WordPress is vulnerable to Missing Authorization to Arbitrary Post/Page Disclosure in versions up to and including 6.7.0. This is due to AJAX field query endpoints accepting user-supplied filter parameters that override field-configured restrictions without proper authorization checks. This makes it possible for unauthenticated attackers with access to a frontend ACF form to enumerate and disclose information about draft/private posts, restricted post types, and other data that should be restricted by field configuration.

 https://cve.radiocsirt.org/vuln/ghsa-24rc-w3ff-pw6w GHSA-24rc-w3ff-pw6w 2026-10-05T21:23:23.176205+00:00

The Advanced Custom Fields (ACF) plugin for WordPress is vulnerable to Missing Authorization to Arbitrary Post/Page Disclosure in versions up to and including 6.7.0. This is due to AJAX field query endpoints accepting user-supplied filter parameters that override field-configured restrictions without proper authorization checks. This makes it possible for unauthenticated attackers with access to a frontend ACF form to enumerate and disclose information about draft/private posts, restricted post types, and other data that should be restricted by field configuration.