WordPress plugin
ACF to REST API security & vulnerabilities
Unpatched vulnerability in the latest version
At least one vulnerability affects the latest version and no fix has been released. Deactivate the plugin or restrict access to the affected feature until the vendor ships a patch.
- Critical0
- High1
- Medium2
- Low0
All ACF to REST API vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| Medium4.3 | Insecure Direct Object Reference to Authenticated (Contributor+) ACF Field/Option Modification ≤3.3.4No patch available | CVE-2025-12030 | |
| Medium5.3 | Unauthenticated Information Exposure ≤3.3.4No patch available | CVE-2025-62979 | |
| High7.5 | Insecure direct object reference via permalinks manipulation ≤3.2.0Update to 3.3.0 | CVE-2020-13700 |
- Medium4.3Insecure Direct Object Reference to Authenticated (Contributor+) ACF Field/Option Modification
≤3.3.4No patch available
- Medium5.3Unauthenticated Information Exposure
≤3.3.4No patch available
- High7.5Insecure direct object reference via permalinks manipulation
≤3.2.0Update to 3.3.0
ACF to REST API: common questions
Does ACF to REST API have known vulnerabilities?
Yes. VulnCrest Radar lists 3 known vulnerabilities in ACF to REST API: 1 high, 2 medium. At least one is not fixed in the latest version.
How do I check which version of ACF to REST API I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent ACF to REST API vulnerability?
CVE-2025-12030, published Jan 6, 2026: ACF to REST API <= 3.3.4 - Insecure Direct Object Reference to Authenticated (Contributor+) ACF Field/Option Modification. Severity: Medium (CVSS 4.3).
Is any ACF to REST API vulnerability listed in CISA KEV?
No. None of the known ACF to REST API vulnerabilities is currently listed in the CISA KEV catalog.