A critical vulnerability was recently patched in Advanced Custom Fields (ACF), one of the most popular plugins in the WordPress ecosystem. This flaw (CVE-2026-4812) allowed unauthenticated users to leak internal data by manipulating AJAX query parameters.
I spent some time digging into the 6.7.0 source code to understand exactly how this worked. It’s a classic example of what happens when client-provided parameters are allowed to override server-side security configuration.
The problem
The issue resides in the AJAX query handlers used by ACF’s relational fields: Relationship, Post Object, and User Query. These fields use AJAX to fetch lists of items to select from while you’re editing a post.
To make these fields flexible, the AJAX handlers accept parameters like post_type, post_status, and taxonomy to filter the results. The problem in version 6.7.0 is that these handlers didn’t strictly validate the incoming parameters against the field’s actual configuration.
Even worse, these endpoints were registered as “nopriv” actions, meaning they were accessible to anyone visiting the site, even without logging in.
How it worked
In class-acf-ajax-query.php and the specific field classes like class-acf-field-relationship.php, the plugin would load the field configuration based on a field_key provided in the request. However, it would then allow the $_POST data to override the query arguments.
If an attacker knew (or guessed) a valid field key, they could send a request to admin-ajax.php with their own filters. For example, they could set post_status to ['private', 'draft'] and use the search parameter s to probe for sensitive titles across the entire database.
Because the plugin used these parameters to build a standard WP_Query, it would happily return titles and IDs for private content that the attacker should never have seen.
The fix
The 6.7.1 and 6.7.2 updates fixed this by implementing strict validation. The plugin now ensures that any requested filters in an AJAX call actually match what is defined in the field settings. It also adds proper capability checks to ensure unauthenticated users can’t query private or draft statuses.
Technical notes
If you’re auditing your own sites, the affected actions are:
acf/fields/relationship/queryacf/fields/post_object/queryacf/ajax/query_users
The root cause was the direct use of $_POST data to populate WP_Query arguments without checking them against the “source of truth” (the field’s saved configuration).
Summary
This was a relatively simple bug with potentially wide-reaching implications given ACF’s install base. It’s a good reminder that “nopriv” AJAX handlers need to be extremely defensive about what they allow the client to control.
For now, the advice is simple: make sure you’ve updated ACF to at least 6.7.2.