PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-66678 Justin Kruit CVE debrief

The Advanced Custom Fields: Font Awesome Field plugin, versions <= 6.1.1, contains a Broken Access Control vulnerability. This vulnerability, classified as MEDIUM severity with a CVSS score of 4.3, could allow unauthorized access to sensitive information or functionality. Users of this plugin should be aware of the potential risks and take necessary actions to mitigate them. The CVE record was published on 2026-08-06T15:17:21.353Z and has not been modified since then. Further verification of affected deployments and review of vendor guidance is recommended.

Vendor
Justin Kruit
Product
Advanced Custom Fields: Font Awesome Field
CVSS
MEDIUM 4.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-06
Original CVE updated
2026-08-06
Advisory published
2026-08-06
Advisory updated
2026-08-06

Who should care

Users of the Advanced Custom Fields: Font Awesome Field plugin, especially those using versions <= 6.1.1, should be aware of this vulnerability and take necessary actions to mitigate it. This includes administrators, security teams, and operators who manage or use the affected plugin. They should review the official advisories, assess their exposure, and plan for vendor-supported updates or mitigations.

Technical summary

The Advanced Custom Fields: Font Awesome Field plugin has a Broken Access Control vulnerability in versions <= 6.1.1. This vulnerability has a CVSS score of 4.3 and is classified as MEDIUM severity. The vulnerability could allow unauthorized access to sensitive information or functionality, potentially impacting users of the plugin. Affected users should review the official CVE record and NVD detail page for further information.

Defensive priority

Medium priority given the CVSS score of 4.3 and the nature of the vulnerability.

Recommended defensive actions

  • Verify the affected product and version
  • Check for vendor-provided patches or updates
  • Implement compensating controls to restrict access
  • Monitor for potential exploitation attempts
  • Review compensating controls for exposed systems while remediation is scheduled and verified

Evidence notes

Evidence is limited; primary official records indicate a Broken Access Control vulnerability in Advanced Custom Fields: Font Awesome Field <= 6.1.1 versions. Further verification is recommended through review of official advisories, CVE records, and potentially affected deployments. Defenders should verify the presence of affected product deployments in their environments and assess the potential impact.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-66678 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-66678

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-66678 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-66678

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.