CVE-2026-12428 is a missing authorization vulnerability (CWE-862) in the Blocks for ACF Fields WordPress plugin. The vulnerability arises because the permission check on the /wp-json/acf-field-blocks/v1/values REST endpoint only verifies the generic publish_posts capability, which is insufficient. The handler function uses a user-supplied id parameter directly in get_field_objects() without verifying the user's authorization to access the targeted post or object. Consequently, authenticated users with Author-level permissions or higher can retrieve ACF field values from arbitrary posts, including private and draft posts belonging to other users.

An attacker with Author-level or higher privileges can access sensitive custom field data from posts they do not own or should not access. This can lead to unauthorized disclosure of potentially sensitive information stored in ACF fields. The vulnerability does not affect integrity or availability but has a high confidentiality impact. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Author-level access to trusted users only and monitor for suspicious activity. Avoid exposing sensitive data in ACF fields accessible via this plugin's REST endpoint.