Authorization bypass in User field AJAX query handler

The acf/fields/user/query AJAX endpoint inherited unfiltered request parameters into WP_User_Query args, so a user with access to the field UI could override the field’s configured role restriction (role__in) and search across privileged user-meta columns including user_email.

This vulnerability affects the following application versions:

• Advanced Custom Fields (ACF) 5.8.9
• Advanced Custom Fields (ACF) 5.8.10
• Advanced Custom Fields (ACF) 5.8.11
• Advanced Custom Fields (ACF) 5.8.12
• Advanced Custom Fields (ACF) 5.8.13
• Advanced Custom Fields (ACF) 5.8.14
• Advanced Custom Fields (ACF) 5.9.0
• Advanced Custom Fields (ACF) 5.9.1
• Advanced Custom Fields (ACF) 5.9.2
• Advanced Custom Fields (ACF) 5.9.3
• Advanced Custom Fields (ACF) 5.9.4
• Advanced Custom Fields (ACF) 5.9.5
• Advanced Custom Fields (ACF) 5.9.6
• Advanced Custom Fields (ACF) 5.9.7
• Advanced Custom Fields (ACF) 5.9.8
• Advanced Custom Fields (ACF) 5.9.9
• Advanced Custom Fields (ACF) 5.10
• Advanced Custom Fields (ACF) 5.10.1
• Advanced Custom Fields (ACF) 5.10.2
• Advanced Custom Fields (ACF) 5.11
• Advanced Custom Fields (ACF) 5.11.1
• Advanced Custom Fields (ACF) 5.11.2
• Advanced Custom Fields (ACF) 5.11.3
• Advanced Custom Fields (ACF) 5.11.4
• Advanced Custom Fields (ACF) 5.12
• Advanced Custom Fields (ACF) 5.12.1
• Advanced Custom Fields (ACF) 5.12.2
• Advanced Custom Fields (ACF) 5.12.3
• Advanced Custom Fields (ACF) 5.12.4
• Advanced Custom Fields (ACF) 5.12.5
• Advanced Custom Fields (ACF) 5.12.6
• Advanced Custom Fields (ACF) 6.0.0
• Advanced Custom Fields (ACF) 6.0.1
• Advanced Custom Fields (ACF) 6.0.2
• Advanced Custom Fields (ACF) 6.0.3
• Advanced Custom Fields (ACF) 6.0.4
• Advanced Custom Fields (ACF) 6.0.5
• Advanced Custom Fields (ACF) 6.0.6
• Advanced Custom Fields (ACF) 6.0.7
• Advanced Custom Fields (ACF) 6.1.0
• Advanced Custom Fields (ACF) 6.1.1
• Advanced Custom Fields (ACF) 6.1.2
• Advanced Custom Fields (ACF) 6.1.3
• Advanced Custom Fields (ACF) 6.1.4
• Advanced Custom Fields (ACF) 6.1.5
• Advanced Custom Fields (ACF) 6.1.6
• Advanced Custom Fields (ACF) 6.1.7
• Advanced Custom Fields (ACF) 6.1.8
• Advanced Custom Fields (ACF) 6.2.0
• Advanced Custom Fields (ACF) 6.2.1
• Advanced Custom Fields (ACF) 6.2.2
• Advanced Custom Fields (ACF) 6.2.3
• Advanced Custom Fields (ACF) 6.2.4
• Advanced Custom Fields (ACF) 6.2.5
• Advanced Custom Fields (ACF) 6.2.6
• Advanced Custom Fields (ACF) 6.2.6.1
• Advanced Custom Fields (ACF) 6.2.7
• Advanced Custom Fields (ACF) 6.2.8
• Advanced Custom Fields (ACF) 6.2.9
• Advanced Custom Fields (ACF) 6.3.0
• Advanced Custom Fields (ACF) 6.3.1
• Advanced Custom Fields (ACF) 6.3.2
• Advanced Custom Fields (ACF) 6.3.3
• Advanced Custom Fields (ACF) 6.3.4
• Advanced Custom Fields (ACF) 6.3.5
• Advanced Custom Fields (ACF) 6.3.6
• Advanced Custom Fields (ACF) 6.3.6.1
• Advanced Custom Fields (ACF) 6.3.6.2
• Advanced Custom Fields (ACF) 6.3.6.3
• Advanced Custom Fields (ACF) 6.3.9
• Advanced Custom Fields (ACF) 6.3.10.2
• Advanced Custom Fields (ACF) 6.3.11
• Advanced Custom Fields (ACF) 6.3.12
• Advanced Custom Fields (ACF) 6.4.0
• Advanced Custom Fields (ACF) 6.4.0.1
• Advanced Custom Fields (ACF) 6.4.1
• Advanced Custom Fields (ACF) 6.4.2
• Advanced Custom Fields (ACF) 6.4.3
• Advanced Custom Fields (ACF) 6.5.0
• Advanced Custom Fields (ACF) 6.5.1
• Advanced Custom Fields (ACF) 6.6.0
• Advanced Custom Fields (ACF) 6.6.1
• Advanced Custom Fields (ACF) 6.6.2
• Advanced Custom Fields (ACF) 6.7.0