CVE-2026-4812 is a missing authorization vulnerability (CWE-862) in the Advanced Custom Fields (ACF) WordPress plugin, versions up to and including 6.7.0. The vulnerability occurs because AJAX endpoints used for field queries accept user-supplied filters that override configured field restrictions without verifying user permissions. This enables unauthenticated attackers who can access a frontend ACF form to enumerate and disclose information about draft, private, or restricted posts and pages that should be protected by the plugin's field configuration.

An attacker without authentication can access sensitive information about draft, private, or restricted posts/pages by exploiting the missing authorization checks in the ACF plugin's AJAX endpoints. This leads to unauthorized disclosure of content that should be protected, impacting confidentiality. There is no indication of integrity or availability impact. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — no official fix or remediation level has been provided by the vendor or advisory. Users should monitor the vendor's official channels for updates and apply any forthcoming patches promptly. Until a fix is available, restricting access to frontend ACF forms or disabling affected AJAX endpoints may reduce exposure.