CVE-2026-66678 Justin Kruit CVE debrief

Who should care

Users of the Advanced Custom Fields: Font Awesome Field plugin, especially those using versions <= 6.1.1, should be aware of this vulnerability and take necessary actions to mitigate it. This includes administrators, security teams, and operators who manage or use the affected plugin. They should review the official advisories, assess their exposure, and plan for vendor-supported updates or mitigations.

Technical summary

The Advanced Custom Fields: Font Awesome Field plugin has a Broken Access Control vulnerability in versions <= 6.1.1. This vulnerability has a CVSS score of 4.3 and is classified as MEDIUM severity. The vulnerability could allow unauthorized access to sensitive information or functionality, potentially impacting users of the plugin. Affected users should review the official CVE record and NVD detail page for further information.

Defensive priority

Medium priority given the CVSS score of 4.3 and the nature of the vulnerability.

Recommended defensive actions

• Verify the affected product and version
• Check for vendor-provided patches or updates
• Implement compensating controls to restrict access
• Monitor for potential exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified

Evidence notes

Evidence is limited; primary official records indicate a Broken Access Control vulnerability in Advanced Custom Fields: Font Awesome Field <= 6.1.1 versions. Further verification is recommended through review of official advisories, CVE records, and potentially affected deployments. Defenders should verify the presence of affected product deployments in their environments and assess the potential impact.

Official resources