missing_auth
ACF_AJS_Update_Field_Groups hooks init at priority 10 with no is_admin(), current_user_can(), or nonce. maybe_update_field_groups() walks acf_get_setting('load_json') (fallback: parent-theme/acf-json) and for each path calls acf_import_field_group() on groups get_json_field_groups() marks as new/newer, then maybe_trash_field_group_from_database() which wp_list_pluck()s all acf-field-group posts (publish + acf-disabled, posts_per_page 99) and acf_trash_field_group($id) for every post_name not present in that directory's JSON keys. isset($key) in the foreach is always true. ACF's own Sync screen requires acf_get_setting('capability') (default manage_options); this plugin performs the same privileged writes on every front-end request. Sister class ACF_AJS_Directory_Structure runs first on the same init and wp_mkdir_p()s missing load_json dirs, so a typical site that stored field groups only in the database gets an empty acf-json folder and then has every group trashed on the next unauthenticated hit. Trash is per-directory against the full DB key set, so an extra empty load_json path (child vs parent theme) also wipes all groups. The HTTP client does not choose the JSON payload (files on disk do), but they do trigger site-wide schema import/delete. $_SERVER['REQUEST_URI'] is only compared to admin_url() (never equal; redirect is dead). No wp_ajax/REST handlers. Upstream last commit is 2017-05-30, header Version is the gulp placeholder NEXT, and there is no Update URI.
includes/class-update-field-groups.php:43-86,150-173
RecommendationDo not mutate field groups on public init. Gate the sync behind is_admin() and current_user_can(acf_get_setting('capability')) (or manage_options), or run it only from admin_init / a WP-CLI command / a capability-checked cron. Never call acf_trash_field_group when the JSON directory is empty, unreadable, or newly created; require an explicit allow-delete flag. Compare JSON keys across all load_json paths before trashing, and restore ACF filter/json settings after import. If the project is unmaintained, remove the plugin and use ACF's built-in Sync UI or a deploy-time WP-CLI import.