CVE-2022-40696 LOW

CVE-2022-40696: WordPress Advanced Custom Fields Plugin 3.1.1-6.0.2 is vulnerable to Sensitive Data Exposure

Vendor Wp Engine
Product Advanced Custom Fields (ACF)
Weakness CWE-200 · Info exposure
Published January 8, 2024
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

3.7/10
Attack vector Network
Attack complexity High
Privileges required None
User interaction None
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

What the vulnerability does

01Description

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in WP Engine Advanced Custom Fields (ACF).This issue affects Advanced Custom Fields (ACF): from 3.1.1 through 6.0.2.

Explanation of Vulnerability in Simple Terms

02Summary

Advanced Custom Fields (ACF) versions 3.1.1 through 6.0.2 expose sensitive field data through an information disclosure vulnerability. An attacker can read private or restricted custom field values without authentication by exploiting a network-accessible endpoint. The vulnerability requires specific conditions to trigger but does not require user interaction. Update to a version newer than 6.0.2 to remediate.

What an attacker can do

03Attacker Capabilities

Read private or restricted custom field data without logging in.

Potential impact on your site

04Site Impact

Sensitive data stored in custom fields may be exposed to unauthenticated visitors.

Conditions required to exploit

05Prerequisites

Network access to the site; specific conditions must be met to trigger the vulnerability.

Key dates

06Disclosure timeline

January 8, 2024 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-6728 Slider Revolution <= 7.0.9 - Unauthenticated Sensitive Information Exposure via 'sliders/stream' CVE-2025-15508 Magic Import Document Extractor <= 1.0.6 - Unauthenticated Sensitive Information Exposure CVE-2025-14726 Widgets for Social Photo Feed <= 1.8 - Missing Authentication to Unauthenticated Plugin Settings Access/Update via trustindex_feed_hook_instagram REST API endpoints CVE-2026-3058 Seraphinite Accelerator <= 2.28.14 - Authenticated (Subscriber+) Exposure of Sensitive Information to an Unauthorized Actor CVE-2026-4409 Subscribe To Comments Reloaded <= 240119 - Improper Authorization to Unauthenticated Arbitrary Subscription Management