ACF Flexible Layouts Manager Missing Authorization Vulnerability Allowing Unauthenticated Custom Field Updates

A vulnerability exists in the ACF Flexible Layouts Manager plugin for WordPress, in all versions through 1.1.6. The issue arises from a lack of proper capability checks in the 'acf_flm_update_template_with_pasted_layout' function, allowing unauthenticated attackers to modify custom field values on posts and pages.

Impact

Exploitation of this vulnerability allows for unauthorized changes to custom field data on individual posts and pages.

Remediation

There is no known patch available for this vulnerability. Users are advised to review the details of the vulnerability and consider uninstalling the affected plugin.