CVE-2025-12937: ACF Flexible Layouts Manager Auth Bypass

CVE-2025-12937 Overview

The ACF Flexible Layouts Manager plugin for WordPress contains a missing authorization vulnerability in the acf_flm_update_template_with_pasted_layout function. All versions up to and including 1.1.6 are affected. The function lacks a capability check, allowing unauthenticated attackers to modify custom field values on individual posts and pages over the network. The flaw is tracked under CWE-862: Missing Authorization.

Critical Impact
Unauthenticated attackers can modify Advanced Custom Fields (ACF) data on any post or page, enabling content tampering, defacement, or injection of attacker-controlled values into published pages.

Affected Products

ACF Flexible Layouts Manager plugin for WordPress
All versions up to and including 1.1.6
WordPress sites using Advanced Custom Fields with the affected plugin

Discovery Timeline

2025-11-18 - CVE-2025-12937 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-12937

Vulnerability Analysis

The vulnerability resides in the plugin's AJAX handler defined in includes/ajax/ajax-paste.php. The handler acf_flm_update_template_with_pasted_layout accepts a request to update template layouts and write field values to posts, but does not verify the requester has the appropriate capability such as edit_post on the target object.

Advanced Custom Fields (ACF) stores structured post metadata that WordPress themes render into public pages. When an AJAX endpoint that mutates this metadata is exposed without an authorization check, any anonymous HTTP client can invoke it. The impact is scoped to data integrity and limited confidentiality, since attackers manipulate field values rather than gain code execution.

With an EPSS probability near 0.181%, active exploitation is not currently observed, but the low attack complexity makes opportunistic scanning likely.

Root Cause

The root cause is a missing capability check in the AJAX callback. WordPress AJAX endpoints registered through wp_ajax_nopriv_* actions execute for unauthenticated users. Without a current_user_can() verification and a valid nonce check inside the callback, the handler processes any inbound request. The plugin trusts client-supplied post identifiers and layout payloads directly.

Attack Vector

An attacker sends a crafted HTTP POST request to wp-admin/admin-ajax.php with the action parameter set to the vulnerable handler and a target post ID plus layout data in the body. No authentication, session, or user interaction is required. The server accepts the request and updates ACF field values on the specified post.

The vulnerability mechanism is described in the WordPress plugin source code and the Wordfence vulnerability report.

Detection Methods for CVE-2025-12937

Indicators of Compromise

Unexpected modifications to ACF custom field values on posts or pages without a corresponding audit log entry from an authenticated editor.
POST requests to /wp-admin/admin-ajax.php containing the action=acf_flm_update_template_with_pasted_layout parameter from unauthenticated sessions.
Anomalous postmeta table writes tied to ACF field keys occurring outside normal editorial workflows.

Detection Strategies

Inspect web server access logs for POST requests to admin-ajax.php referencing the vulnerable action name, particularly from IPs without a matching authenticated session cookie.
Compare current ACF field values against known-good backups to identify unauthorized changes.
Enable WordPress audit logging plugins to record post metadata changes with attributable user context.

Monitoring Recommendations

Alert on high-volume AJAX requests from a single source IP targeting admin-ajax.php endpoints.
Monitor plugin inventory for acf-flexible-layouts-manager versions at or below 1.1.6 across managed WordPress sites.
Track outbound modifications to published content and flag content that changes without corresponding CMS user activity.

How to Mitigate CVE-2025-12937

Immediate Actions Required

Update the ACF Flexible Layouts Manager plugin to a version above 1.1.6 as soon as a patched release is available from the vendor.
If no patched version exists, deactivate and remove the plugin from all WordPress installations.
Audit ACF field values on public-facing posts and pages to identify and revert unauthorized modifications.

Patch Information

At the time of publication, review the Wordfence vulnerability report for the latest patched version status. Apply the vendor update through the WordPress plugin dashboard once released.

Workarounds

Block requests to admin-ajax.php where the action parameter equals acf_flm_update_template_with_pasted_layout using a web application firewall (WAF) rule.
Restrict access to wp-admin/admin-ajax.php for unauthenticated users at the reverse proxy or WAF layer where feasible.
Enforce IP allowlisting on the WordPress administrative interface for environments where public editing is not required.

bash

# Example ModSecurity WAF rule to block the vulnerable action
SecRule REQUEST_URI "@endsWith /wp-admin/admin-ajax.php" \
    "chain,phase:2,deny,status:403,id:1029371,\
    msg:'Block CVE-2025-12937 ACF FLM unauthorized action'"
    SecRule ARGS:action "@streq acf_flm_update_template_with_pasted_layout"