CVE-2025-12030

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-12030", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-10-21T15:58:35.995Z", "datePublished": "2026-01-07T08:21:52.274Z", "dateUpdated": "2026-04-08T16:55:13.054Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:55:13.054Z"}, "affected": [{"vendor": "airesvsg", "product": "ACF to REST API", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.3.4", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The ACF to REST API plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.3.4. This is due to insufficient capability checks in the update_item_permissions_check() method, which only verifies that the current user has the edit_posts capability without checking object-specific permissions (e.g., edit_post($id), edit_user($id), manage_options). This makes it possible for authenticated attackers, with Contributor-level access and above, to modify ACF fields on posts they do not own, any user account, comments, taxonomy terms, and even the global options page via the /wp-json/acf/v3/{type}/{id} endpoints, granted they can authenticate to the site."}], "title": "ACF to REST API <= 3.3.4 - Insecure Direct Object Reference to Authenticated (Contributor+) ACF Field/Option Modification", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5ab508fa-298c-48c1-8510-f2e0a881675a?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/acf-to-rest-api/tags/3.3.4/v3/lib/endpoints/class-acf-to-rest-api-controller.php#L108"}, {"url": "https://plugins.trac.wordpress.org/browser/acf-to-rest-api/tags/3.3.4/v3/lib/endpoints/class-acf-to-rest-api-controller.php#L120"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-639 Authorization Bypass Through User-Controlled Key", "cweId": "CWE-639", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Kai Aizen"}], "timeline": [{"time": "2026-01-06T19:59:52.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-07T16:38:28.047660Z", "id": "CVE-2025-12030", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-07T16:38:36.216Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-12030", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-07T16:38:28.047660Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-07T16:38:33.378Z"}}], "cna": {"title": "ACF to REST API <= 3.3.4 - Insecure Direct Object Reference to Authenticated (Contributor+) ACF Field/Option Modification", "credits": [{"lang": "en", "type": "finder", "value": "Kai Aizen"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "airesvsg", "product": "ACF to REST API", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "3.3.4"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-01-06T19:59:52.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5ab508fa-298c-48c1-8510-f2e0a881675a?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/acf-to-rest-api/tags/3.3.4/v3/lib/endpoints/class-acf-to-rest-api-controller.php#L108"}, {"url": "https://plugins.trac.wordpress.org/browser/acf-to-rest-api/tags/3.3.4/v3/lib/endpoints/class-acf-to-rest-api-controller.php#L120"}], "descriptions": [{"lang": "en", "value": "The ACF to REST API plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.3.4. This is due to insufficient capability checks in the update_item_permissions_check() method, which only verifies that the current user has the edit_posts capability without checking object-specific permissions (e.g., edit_post($id), edit_user($id), manage_options). This makes it possible for authenticated attackers, with Contributor-level access and above, to modify ACF fields on posts they do not own, any user account, comments, taxonomy terms, and even the global options page via the /wp-json/acf/v3/{type}/{id} endpoints, granted they can authenticate to the site."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-639", "description": "CWE-639 Authorization Bypass Through User-Controlled Key"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:55:13.054Z"}}}, "cveMetadata": {"cveId": "CVE-2025-12030", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:55:13.054Z", "dateReserved": "2025-10-21T15:58:35.995Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-01-07T08:21:52.274Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "ACF to REST API", "vendor": "airesvsg", "versions": [{"lessThanOrEqual": "3.3.4", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The ACF to REST API plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.3.4. This is due to insufficient capability checks in the update_item_permissions_check() method, which only verifies that the current user has the edit_posts capability without checking object-specific permissions (e.g., edit_post($id), edit_user($id), manage_options). This makes it possible for authenticated attackers, with Contributor-level access and above, to modify ACF fields on posts they do not own, any user account, comments, taxonomy terms, and even the global options page via the /wp-json/acf/v3/{type}/{id} endpoints, granted they can authenticate to the site."}, {"lang": "es", "value": "El plugin ACF to REST API para WordPress es vulnerable a Referencia Directa Insegura a Objeto en todas las versiones hasta la 3.3.4, inclusive. Esto se debe a comprobaciones de capacidad insuficientes en el m\u00e9todo update_item_permissions_check(), que solo verifica que el usuario actual tiene la capacidad edit_posts sin verificar permisos espec\u00edficos del objeto (por ejemplo, edit_post($id), edit_user($id), manage_options). Esto hace posible que atacantes autenticados, con acceso de nivel Colaborador y superior, modifiquen campos ACF en publicaciones que no les pertenecen, cualquier cuenta de usuario, comentarios, t\u00e9rminos de taxonom\u00eda, e incluso la p\u00e1gina de opciones globales a trav\u00e9s de los endpoints /wp-json/acf/v3/{type}/{id}, siempre que puedan autenticarse en el sitio."}], "id": "CVE-2025-12030", "lastModified": "2026-06-17T08:31:35.833", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-12030", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-07T16:38:28.047660Z", "version": "2.0.3"}}]}, "published": "2026-01-07T12:16:46.557", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/acf-to-rest-api/tags/3.3.4/v3/lib/endpoints/class-acf-to-rest-api-controller.php#L108"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/acf-to-rest-api/tags/3.3.4/v3/lib/endpoints/class-acf-to-rest-api-controller.php#L120"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5ab508fa-298c-48c1-8510-f2e0a881675a?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-639"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T11:53:13.355996+00:00", "value": {"mitigation_remediation": ["Upgrade the ACF to REST API plugin to a version newer than 3.3.4 where the permission check is corrected.", "If an upgrade is not immediately possible, restrict or block access to the /wp-json/acf/v3/ endpoints for Contributor and lower roles using a security plugin or .htaccess rules.", "Review the REST API configuration and remove any exposed endpoints that allow object\u2011level editing for non\u2011administrator users, ensuring that capability checks match the object being modified."], "summary": {"action": "Apply patch", "impact": "Unauthorized modification of content and options"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the ACF to REST API plugin for WordPress, specifically all releases up to and including version 3.3.4. Any WordPress installation that has this plugin installed and is accessible to authenticated contributors or higher roles is impacted.", "description_and_impact": "The ACF to REST API plugin for WordPress suffers from an insecure direct object reference that allows any authenticated user with Contributor or higher privileges to modify Advanced Custom Fields on posts they do not own, user accounts, comments, taxonomy terms, and global options through REST API endpoints. This vulnerability is a classic example of CWE-639, where insufficient object\u2011level permission checks are performed.", "risk_and_exploitability": "With a CVSS score of 4.3 the risk is considered medium and the EPSS score of less than 1% indicates a very low yet non\u2011zero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to authenticate to the site and then send requests to the endpoints /wp-json/acf/v3/{type}/{id}. Successful exploitation allows the attacker to alter content and configuration without owning the items, leading to unauthorized data modification and potential privilege escalation."}}}}, "created": "2026-01-08T09:49:54.305462+00:00", "updated": "2026-04-22T12:00:05.905526+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}