CVE-2026-66678 in Advanced Custom Fields Font Awesome Field Plugin
Summary
by MITRE • 08/06/2026
Contributor Broken Access Control in Advanced Custom Fields: Font Awesome Field <= 6.1.1 versions.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/06/2026
The vulnerability identified in Advanced Custom Fields Font Awesome Field plugin affects versions 6.1.1 and earlier, representing a critical broken access control flaw that could enable unauthorized users to bypass security restrictions. This issue stems from inadequate permission validation within the plugin's administrative interfaces where users with insufficient privileges can potentially access restricted functionality through manipulated requests or direct URL access attempts.
The technical implementation of this vulnerability occurs when the plugin fails to properly verify user permissions before executing sensitive operations or serving restricted content. Attackers can exploit this weakness by crafting malicious requests that target administrative endpoints or by directly accessing protected resources without proper authentication checks. The flaw typically manifests when the plugin does not adequately validate whether the current user possesses sufficient capabilities to perform specific actions, allowing privilege escalation scenarios where low-privilege users gain access to high-privilege functions.
The operational impact of this vulnerability extends beyond simple unauthorized access as it can enable attackers to modify critical site configurations, inject malicious content, or potentially escalate their privileges within the WordPress environment. When exploited successfully, the vulnerability could allow an attacker with minimal privileges to perform administrative tasks such as adding new users, modifying existing content, altering plugin settings, or accessing sensitive data that should remain protected. This represents a significant risk to WordPress installations relying on this plugin for custom field management.
Security professionals should recognize this issue as classified under CWE-285: Improper Authorization, which specifically addresses failures in enforcing access control mechanisms within software applications. The vulnerability aligns with ATT&CK technique T1078.004: Valid Accounts, where adversaries leverage legitimate credentials to gain access to restricted functionality by exploiting insufficient authorization controls. Organizations using this plugin should immediately update to version 6.1.2 or later where the access control mechanisms have been properly implemented and validated.
Mitigation strategies include implementing immediate patch management procedures to upgrade to the latest plugin versions, conducting comprehensive security audits of all installed plugins for similar access control flaws, and establishing robust monitoring systems to detect unauthorized access attempts. Additionally, administrators should review and tighten WordPress user role configurations, implement multi-factor authentication where possible, and consider network-level restrictions that limit direct access to administrative interfaces. Regular security scanning of the WordPress environment using vulnerability assessment tools can help identify other potential access control weaknesses that may require similar remediation efforts.
The broader implications of this vulnerability highlight the critical importance of proper authorization implementation in content management systems and web applications. It demonstrates how seemingly minor permission validation oversights can create significant security risks, particularly in environments where multiple user roles exist with varying levels of access privileges. Organizations should treat this class of vulnerability as a priority for remediation and incorporate regular access control reviews into their overall security posture assessments to prevent similar issues from emerging in other components of their web applications.