Description

Contributor Broken Access Control in Advanced Custom Fields: Font Awesome Field <= 6.1.1 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-06T15:17:21.353Z",
  "pubdate": "2026-08-06T15:17:21.353Z",
  "executiveSummary": "A broken access control vulnerability has been identified in the Advanced Custom Fields: Font Awesome Field plugin affecting versions <= 6.1.1. This security flaw introduces significant risk by potentially allowing unauthorized users, specifically those with low-privilege roles such as contributors, to perform restricted actions that should typically be reserved for higher-privileged administrators or editors.\nThe vulnerability stems from insufficient permission validation and access restriction enforcement within the plugin's codebase. An authenticated attacker possessing contributor-level privileges can leverage this flaw to bypass intended authorization boundaries, leading to unauthorized data manipulation or exposure.\nThe impact of this vulnerability includes potential unauthorized modification of site settings or content structures managed by the Advanced Custom Fields ecosystem, depending on the specific capabilities improperly exposed by the plugin. Exploitation requires authenticated access with contributor-level privileges, meaning an attacker must first obtain or compromise a low-privileged user account on the target WordPress installation.\nThe risk implication is moderate to high, as it violates the principle of least privilege and provides a vector for privilege escalation or unauthorized state changes within the content management system. Remediation requires updating the affected Advanced Custom Fields: Font Awesome Field plugin to a patched version once available, or disabling the component if no fix is accessible.",
  "technicalDetails": "The root cause of the vulnerability resides in the inadequate implementation of capability checks and nonce verification within the AJAX handlers or administrative action endpoints of the Advanced Custom Fields: Font Awesome Field plugin for versions <= 6.1.1.\nIn WordPress plugin development, functions handling backend requests must explicitly verify user capabilities using functions such as current_user_can() and validate cryptographic nonces to ensure requests originate from legitimate user sessions with appropriate privileges. The vulnerable component fails to adequately enforce these checks for specific actions accessible to the contributor role.\nThe attack flow proceeds as follows: First, the attacker authenticates to the target WordPress instance using a compromised or legitimately acquired contributor-level account. Second, the attacker crafts a malicious HTTP request targeting the insecure endpoint exposed by the Advanced Custom Fields: Font Awesome Field plugin. Because the backend code lacks proper privilege verification, the application processes the request despite the sender lacking the requisite administrative permissions.\nThe payload behavior involves invoking restricted functionality intended only for trusted users, allowing the low-privileged attacker to execute unauthorized operations within the scope of the plugin. The network exposure is restricted to authenticated users, requiring network access to the WordPress administrative or AJAX interface. Post-exploitation impact may include unauthorized configuration changes, metadata manipulation, or further exploitation chaining depending on how the exposed functions interact with the broader WordPress environment and database."
}