CVE-2026-66678

MediumCVSS 4.3

Published: 06/08/2026(UTC)Updated: 24/10/2026(UTC)Translated: 06/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.27%

19th percentile - higher than 19% of all known CVEs

Summary

Broken Access Control vulnerability in Advanced Custom Fields: Font Awesome Field versions up to 6.1.1 allows a user with Contributor role to access unauthorized functions.

Risk Assessment

A low-privileged user can perform operations they should not have access to, potentially leading to data integrity compromise.

Recommendation

Update the Advanced Custom Fields: Font Awesome Field plugin to the latest version that fixes the access control issue.

Other vulnerabilities in Advanced Custom Fields: Font Awesome Field

CVE-2026-49044Medium
The Advanced Custom Fields: Font Awesome Field plugin (through 5.0.2) contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. Malicious JavaScript can be stored and executed in a user's browser.

Original NVD description (English source)

Contributor Broken Access Control in Advanced Custom Fields: Font Awesome Field <= 6.1.1 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS