{
 "id": "WPSEC-2026-2420",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2420/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2420/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2420/index.md",
 "title": "Advanced Custom Fields (ACF®) <= 6.8.10 - Authenticated (Contributor+) Missing Authorization to Unrendered Field Value Update",
 "description": "The Advanced Custom Fields (ACF®) plugin for WordPress is vulnerable to unauthorized modification of data in all versions up to, and including, 6.8.10. This is due to the save handlers for posts, terms, attachments, menus, widgets and the customizer passing every submitted acf[field_key] value to acf_update_values() without checking that the field was rendered for the object or that its field group's location rules match it, and to ACF field meta not being protected from WordPress's Custom Fields meta box, its add_meta AJAX handler and XML-RPC. This makes it possible for authenticated attackers with contributor-level access and above to write values to ACF fields they were never shown, such as fields from field groups restricted to other roles or content, on posts they can edit.",
 "plugin": {
  "slug": "advanced-custom-fields",
  "name": "Advanced Custom Fields (ACF®)",
  "full_name": "Advanced Custom Fields (ACF®)",
  "wordpress_org": "https://wordpress.org/plugins/advanced-custom-fields/",
  "advisories_url": "https://wpsec.com/vuln/plugin/advanced-custom-fields/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/advanced-custom-fields"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "6.8.11",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 6.8.11"
  ]
 },
 "introduced_in": null,
 "fixed_in": "6.8.11",
 "remediation": "Update to 6.8.11 or later.",
 "fix_released": "2026-11-02T17:41:51+00:00",
 "published": "2026-11-03T17:48:37+00:00",
 "updated": "2026-11-03T13:19:17.736344+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2420/",
  "https://plugins.svn.wordpress.org/advanced-custom-fields/tags/6.8.11/",
  "https://wordpress.org/plugins/advanced-custom-fields/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/advanced-custom-fields",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-11-03"
 }
}