CVE-2026-54239 is a high-severity vulnerability in the FaustWP WordPress plugin, part of the Faust.js headless WordPress toolkit. Versions prior to 1.8.11 improperly authenticate token data by excluding the initialization vector from the HMAC, allowing a logged-in non-administrator to manipulate tokens. This manipulation can escalate privileges to administrator level, enabling full REST API access, administrator account creation, plugin installation, and arbitrary code execution. The issue is fixed in version 1.8.11.
The Advanced Custom Fields (ACF®) WordPress plugin up to version 6.8.1 contains an authorization bypass vulnerability. This flaw allows unauthenticated attackers to overwrite the post_title and post_content of any post linked to a publicly accessible acf_form() by injecting values into form submission parameters. The vulnerability is classified as CWE-862 (Missing Authorization). It has a CVSS 3.1 base score of 5.3, indicating medium severity. No official patch or remediation guidance is currently provided by the vendor. There are no known exploits in the wild at this time.
The Database Backup for WordPress plugin (up to version 2.5.2) contains a vulnerability that allows unauthenticated attackers to export database tables without proper authorization. This issue arises because the plugin fails to correctly enforce the return value of its authorization check. The vulnerability is specifically exploitable only in WordPress Multisite environments where the deprecated is_site_admin() function is present. Exploitation can lead to exposure of sensitive information from the database.
The Database Backup for WordPress plugin up to version 2.5.2 contains a missing authorization vulnerability that allows unauthenticated attackers to read and delete arbitrary files on the server. This issue arises from improper enforcement of authorization checks combined with a user-controlled backup directory parameter. Exploitation is limited to WordPress Multisite environments where the deprecated is_site_admin() function is present. The vulnerability can lead to sensitive information exposure and potential site takeover. There is currently no confirmed patch or official remediation available.
The Database Backup for WordPress plugin (up to version 2.5.2) contains an authorization bypass vulnerability that allows unauthenticated attackers to manipulate the backup directory parameter. This can lead to exposure of database backup files containing sensitive information such as database credentials, user password hashes, and personally identifiable information. Exploitation requires scheduled backups to be configured by the site administrator. The vulnerability has a high severity with a CVSS score of 7.5.
The Advanced Custom Fields (ACF) plugin for WordPress up to version 6.7.0 has a missing authorization vulnerability that allows unauthenticated attackers with access to a frontend ACF form to enumerate and disclose information about draft, private, or otherwise restricted posts and data. This occurs because AJAX field query endpoints accept user-supplied filter parameters that override field-configured restrictions without proper authorization checks. The vulnerability does not impact integrity or availability, only confidentiality of certain restricted content.
The WP Migrate Lite – WordPress Migration Made Easy plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 2.7.6 via the wpmdb_flush AJAX action. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to obtain information about internal services.
An HTML injection vulnerability exists in WordPress plugin "Advanced Custom Fields" prior to 6.4.3. If this vulnerability is exploited, crafted HTML code may be rendered and page display may be tampered.
Missing Authorization vulnerability in WPEngine Inc. Advanced Custom Fields PRO allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced Custom Fields PRO: from n/a through 6.3.1.
Missing Authorization vulnerability in WPEngine Inc. Advanced Custom Fields PRO allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced Custom Fields PRO: from n/a through 6.3.1.
Vulnerability discovered by executing a planned security audit.
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WPENGINE INC Advanced Custom Fields PRO allows PHP Local File Inclusion.This issue affects Advanced Custom Fields PRO: from n/a before 6.2.10.
Vulnerability discovered by executing a planned security audit.
Improper Control of Generation of Code ('Code Injection') vulnerability in WPENGINE INC Advanced Custom Fields PRO allows Code Injection.This issue affects Advanced Custom Fields PRO: from n/a before 6.2.10.