CVE-2025-12030: 
WordPress vulnerability analysis and mitigation

CVE-2025-12030 is an Insecure Direct Object Reference (IDOR) vulnerability in the ACF to REST API plugin for WordPress, affecting all versions up to and including 3.3.4. The flaw allows authenticated attackers with Contributor-level access or above to modify Advanced Custom Fields (ACF) data on objects they do not own — including posts, user accounts, comments, taxonomy terms, and the global options page — via the /wp-json/acf/v3/{type}/{id} REST API endpoints. It was disclosed on January 7, 2026, with Wordfence as the assigning CNA. The vulnerability carries a CVSS v3.1 base score of 4.3 (Medium) (Wordfence).

The root cause is insufficient authorization logic in the update_item_permissions_check() method of the plugin's REST API controller (class-acf-to-rest-api-controller.php, lines 108 and 120). The method only verifies that the requesting user holds the generic edit_posts capability, without performing object-specific permission checks such as edit_post($id), edit_user($id), or manage_options. This constitutes an Authorization Bypass Through User-Controlled Key (CWE-639), as an attacker can supply arbitrary object IDs in the REST endpoint path to target resources they are not authorized to modify. A proof-of-concept exploit is publicly available on GitHub (Wordfence, PoC GitHub).

Successful exploitation allows authenticated attackers (Contributor role or higher) to make unauthorized modifications to ACF field data across a wide range of WordPress objects, including posts owned by other users, any user account's metadata, comments, taxonomy terms, and site-wide options via the global options page. While confidentiality and availability are not directly impacted, the integrity impact is significant: an attacker could alter user profile data, manipulate site configuration stored in ACF options, or tamper with content across the site without proper authorization. This could facilitate privilege escalation, content defacement, or persistent site misconfiguration (Wordfence).

A proof-of-concept exploit is publicly available on GitHub (added March 2, 2026), though there is no evidence of active in-the-wild exploitation at this time (PoC GitHub). The vulnerability requires authentication at the Contributor level or above, which limits opportunistic exploitation but remains a realistic threat on sites with open registration or multiple contributors. The EPSS score is approximately 0.02%, reflecting low current exploitation probability. The CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Reconnaissance: Identify WordPress sites running the ACF to REST API plugin (version ≤ 3.3.4) by probing the /wp-json/acf/v3/ endpoint, which returns ACF field data if the plugin is active.
2. Obtain Contributor-level credentials: Register as a contributor on the target site (if open registration is enabled) or use compromised credentials.
3. Enumerate target object IDs: Query the REST API (e.g., /wp-json/wp/v2/posts, /wp-json/wp/v2/users) to enumerate post IDs, user IDs, or other object identifiers on the site.
4. Craft malicious PATCH/PUT request: Send an authenticated HTTP PATCH or PUT request to /wp-json/acf/v3/{type}/{id} (e.g., /wp-json/acf/v3/users/1 to target the admin account), supplying modified ACF field values in the request body.
5. Bypass authorization: Because update_item_permissions_check() only validates edit_posts capability, the request is accepted without verifying ownership or object-specific permissions.
6. Achieve unauthorized modification: ACF fields on the targeted object (post, user, comment, taxonomy term, or options page) are updated, potentially altering site configuration, user metadata, or content (Wordfence, PoC GitHub).

• Network: Unusual authenticated PATCH or PUT requests to /wp-json/acf/v3/{type}/{id} endpoints from Contributor-level accounts, especially targeting user IDs, options, or posts not owned by the requesting user.
• Logs: WordPress access logs showing REST API requests to /wp-json/acf/v3/users/, /wp-json/acf/v3/options/, or other sensitive object types from low-privileged accounts; repeated requests across multiple object IDs suggesting enumeration.
• Application: Unexpected changes to ACF field values on posts, user profiles, or site options not attributable to authorized editors or administrators.
• User Activity: Contributor-level accounts making REST API calls outside normal content editing patterns, particularly to endpoints for users or site options.

Update the ACF to REST API plugin to version 3.3.5 or later, which addresses the insufficient capability checks in update_item_permissions_check() (Wordfence). As an interim workaround, restrict Contributor-level user registration and access if not operationally required, or temporarily disable the ACF REST API endpoints. Additionally, monitor REST API access logs for suspicious activity targeting /wp-json/acf/v3/ endpoints from low-privileged accounts.

Wordfence disclosed the vulnerability and assigned the CVE on January 7, 2026, providing a detailed advisory and threat intelligence entry. No significant broader media coverage or notable researcher commentary beyond the Wordfence disclosure and the GitHub PoC publication has been identified.