The Advanced Forms for ACF plugin for WordPress contains a missing authorization vulnerability (CWE-862) in the export_json_file() function in all versions up to 1.9.3.2. This flaw allows unauthenticated attackers to export form settings without proper capability checks. The CVSS 3.1 base score is 5.3 (medium), reflecting network attack vector, low complexity, no privileges required, no user interaction, and limited confidentiality impact. No vendor advisory or patch information is provided, and the plugin is not a cloud service.

An attacker can access and export form settings data without authentication, potentially exposing sensitive configuration details. There is no impact on data integrity or availability. This unauthorized data disclosure could aid further attacks or information gathering but does not directly compromise system control or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the plugin and monitor for updates from the vendor. Consider disabling or limiting the use of the export_json_file() function if possible.