The ACF Flexible Layouts Manager plugin for WordPress suffers from a missing capability check in the 'acf_flm_update_template_with_pasted_layout' function in all versions up to 1.1.6. This authorization bypass vulnerability (CWE-862) enables unauthenticated attackers to update custom field values on individual posts and pages, potentially altering site content without permission. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and impacts on confidentiality and integrity but not availability. No known exploits in the wild or patches are currently documented.

An attacker without authentication can modify custom field data on posts and pages, potentially leading to unauthorized content changes or data integrity issues. There is no indication of impact on system availability. The vulnerability could undermine trust in site content but does not directly enable remote code execution or privilege escalation based on the available data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the plugin's update functionality where possible and monitor for suspicious activity related to custom field modifications. Avoid exposing the vulnerable plugin on publicly accessible sites without additional access controls.