Current implementation allows the acf shortcode to access different fields in posts that are not public when you access it form a different post.
This vulnerability affects the following application versions:
- Advanced Custom Fields (ACF) 6.0.3
- Advanced Custom Fields (ACF) 6.0.4
- Advanced Custom Fields (ACF) 6.0.5
- Advanced Custom Fields (ACF) 6.0.6
- Advanced Custom Fields (ACF) 6.0.7
- Advanced Custom Fields (ACF) 6.1.0
- Advanced Custom Fields (ACF) 6.1.1
- Advanced Custom Fields (ACF) 6.1.2
- Advanced Custom Fields (ACF) 6.1.3
- Advanced Custom Fields (ACF) 6.1.4
- Advanced Custom Fields (ACF) 6.1.5
- Advanced Custom Fields (ACF) 6.1.6
- Advanced Custom Fields (ACF) 6.1.7
- Advanced Custom Fields (ACF) 6.1.8
- Advanced Custom Fields (ACF) 6.2.0
- Advanced Custom Fields (ACF) 6.2.1
- Advanced Custom Fields (ACF) 6.2.2
- Advanced Custom Fields (ACF) 6.2.3
- Advanced Custom Fields (ACF) 6.2.4
- Advanced Custom Fields (ACF) 6.2.5
- Advanced Custom Fields (ACF) 6.2.6
- Advanced Custom Fields (ACF) 6.2.6.1
- Advanced Custom Fields (ACF) 6.2.7
- Advanced Custom Fields (ACF) 6.2.8
- Advanced Custom Fields (ACF) 6.2.9
- Advanced Custom Fields (ACF) 6.3.0
- Advanced Custom Fields (ACF) 6.3.1
- Advanced Custom Fields (ACF) 6.3.2
- Advanced Custom Fields (ACF) 6.3.3