Acf To Rest Api
Approved changes feed: RSS · Atom
cpe:2.3:a:airesvsg:acf_to_rest_api:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Airesvsg (faf9c68b-0a15-5dbd-81e3-70593c23e8a7) |
|---|---|
| Product | Acf To Rest Api (09724af8-6f96-5f84-b2ae-c22a6a0bd95e) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-62979 |
vulnerable | 2026-06-08 07:39:17.116572 |
WordPress ACF to REST API plugin <= 3.3.4 - Sensitive Data Exposure vulnerability
MEDIUM (5.3)
Insertion of Sensitive Information Into Sent Data vulnerability in airesvsg ACF to REST API acf-to-rest-api allows Retrieve Embedded Sensitive Data.This issue affects ACF to REST API: from n/a through <= 3.3.4.
Published: 2025-10-27T01:34:18.671Z
Updated: 2026-04-28T18:59:41.155Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-12030 |
vulnerable | 2026-06-08 07:04:29.585016 |
ACF to REST API <= 3.3.4 - Insecure Direct Object Reference to Authenticated (Contributor+) ACF Field/Option Modification
MEDIUM (4.3)
The ACF to REST API plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.3.4. This is due to insufficient capability checks in the update_item_permissions_check() method, which only verifies that the current user has the edit_posts capability without checking object-specific permissions (e.g., edit_post($id), edit_user($id), manage_options). This makes it possible for authenticated attackers, with Contributor-level access and above, to modify ACF fields on posts they do not own, any user account, comments, taxonomy terms, and even the global options page via the /wp-json/acf/v3/{type}/{id} endpoints, granted they can authenticate to the site.
Published: 2026-01-07T08:21:52.274Z
Updated: 2026-04-08T16:55:13.054Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.