Advanced Custom Fields (ACF®) < 6.8.2 - Unauthenticated Arbitrary Field Value Update via Front-End Form

Description

The plugin does not restrict front-end form submissions to the fields that the form actually exposes, allowing unauthenticated users with access to a publicly accessible form to update the value of any of its fields on the bound post, including fields the form does not display.