Advanced Custom Fields (ACF®) <= 6.8.10 - Authenticated (Contributor+) Missing Authorization to Unrendered Field Value Update
- ID
- WPSEC-2026-2420
- Plugin
- Advanced Custom Fields (ACF®) (advanced-custom-fields)
- Affected
- all versions before 6.8.11
- Remediation
- Update to 6.8.11 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-03
- Attack surface
- Advanced Custom Fields (ACF®) on WPSec AttackSurface
- Fix released
- Published
Description
The Advanced Custom Fields (ACF®) plugin for WordPress is vulnerable to unauthorized modification of data in all versions up to, and including, 6.8.10. This is due to the save handlers for posts, terms, attachments, menus, widgets and the customizer passing every submitted acf[field_key] value to acf_update_values() without checking that the field was rendered for the object or that its field group's location rules match it, and to ACF field meta not being protected from WordPress's Custom Fields meta box, its add_meta AJAX handler and XML-RPC. This makes it possible for authenticated attackers with contributor-level access and above to write values to ACF fields they were never shown, such as fields from field groups restricted to other roles or content, on posts they can edit.
References
- https://wpsec.com/vuln/WPSEC-2026-2420/
- https://plugins.svn.wordpress.org/advanced-custom-fields/tags/6.8.11/
- https://wordpress.org/plugins/advanced-custom-fields/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS