CVE-2025-12030 is an authorization bypass vulnerability classified under CWE-639 (Authorization Bypass Through User-Controlled Key) affecting the ACF to REST API plugin for WordPress. The flaw exists because the update_item_permissions_check() method inadequately verifies user capabilities; it only checks for the generic edit_posts capability rather than object-specific permissions such as edit_post($id), edit_user($id), or manage_options. This insufficient validation allows authenticated users with Contributor-level access or higher to modify Advanced Custom Fields on posts they do not own, as well as alter user accounts, comments, taxonomy terms, and global options through the REST API endpoints structured as /wp-json/acf/v3/{type}/{id}. Since the vulnerability requires authentication but no further user interaction, it can be exploited by any user with minimal privileges beyond Contributor. The impact is primarily on data integrity, as unauthorized modifications can be made to content and configuration settings. The vulnerability affects all versions up to and including 3.3.4 of the plugin. Although no public exploits are reported, the ease of exploitation and the widespread use of WordPress and this plugin make it a significant concern. The CVSS score is 4.3 (medium), reflecting the low complexity of attack but limited impact on confidentiality and availability.

For European organizations, this vulnerability poses a risk to the integrity of website content and configuration. Attackers with Contributor-level access can deface posts, manipulate user data, alter comments, and change global options, potentially undermining trust and operational stability. Organizations relying on WordPress sites for public-facing content, e-commerce, or internal portals could face reputational damage, data corruption, or unauthorized privilege escalation if attackers leverage this flaw to escalate their access or disrupt services. The impact is heightened in sectors where content integrity is critical, such as media, government, and financial services. Since the vulnerability requires authentication, the risk is greater in environments with many users having Contributor or higher privileges, or where credential compromise is possible. The lack of known exploits reduces immediate threat but does not eliminate the risk of future attacks.

1. Monitor for and apply official patches or updates from the plugin vendor as soon as they become available. 2. Until patched, restrict the number of users with Contributor-level or higher access, enforcing the principle of least privilege. 3. Implement additional access control mechanisms on REST API endpoints, such as custom permission checks or endpoint restrictions via security plugins or web application firewalls. 4. Regularly audit user roles and capabilities to ensure no excessive permissions are granted. 5. Employ monitoring and alerting on unexpected changes to ACF fields, user accounts, comments, and global options to detect potential exploitation. 6. Consider disabling or limiting the use of the ACF to REST API plugin if it is not essential. 7. Harden authentication mechanisms, including multi-factor authentication, to reduce the risk of credential compromise. 8. Review and restrict REST API access to trusted users and IP ranges where feasible.