CVE-2024-3072 is a missing authorization vulnerability (CWE-862) in the horiondigital ACF Front End Editor plugin for WordPress. The issue arises from the lack of a capability check in the update_texts() function, enabling authenticated users with minimal privileges (subscriber and above) to update arbitrary post titles, content, and ACF data. This vulnerability affects all versions up to and including 2.0.2. The CVSS 3.1 base score is 4.3, reflecting a network attack vector with low attack complexity, requiring low privileges but no user interaction, and impacts integrity only.

An attacker with subscriber-level access or higher can modify post titles, content, and ACF data without authorization. This unauthorized modification can lead to data integrity issues on affected WordPress sites using the vulnerable plugin. There is no indication of confidentiality or availability impact. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles to trusted users only and monitor for unauthorized content changes. Avoid granting subscriber or higher privileges to untrusted users on sites using this plugin.