# Advanced Custom Fields (ACF®) <= 6.8.10 - Authenticated (Contributor+) Missing Authorization to Unrendered Field Value Update

- **ID:** WPSEC-2026-2420
- **Plugin:** Advanced Custom Fields (ACF®) (`advanced-custom-fields`), https://wordpress.org/plugins/advanced-custom-fields/
- **Affected versions:** all versions before 6.8.11
- **Fixed in:** 6.8.11 (Update to 6.8.11 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-03)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/advanced-custom-fields
- **Fix released:** 2026-11-02
- **Published:** 2026-11-03
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2420/

## Description

The Advanced Custom Fields (ACF®) plugin for WordPress is vulnerable to unauthorized modification of data in all versions up to, and including, 6.8.10. This is due to the save handlers for posts, terms, attachments, menus, widgets and the customizer passing every submitted acf[field_key] value to acf_update_values() without checking that the field was rendered for the object or that its field group's location rules match it, and to ACF field meta not being protected from WordPress's Custom Fields meta box, its add_meta AJAX handler and XML-RPC. This makes it possible for authenticated attackers with contributor-level access and above to write values to ACF fields they were never shown, such as fields from field groups restricted to other roles or content, on posts they can edit.

## References

- https://wpsec.com/vuln/WPSEC-2026-2420/
- https://plugins.svn.wordpress.org/advanced-custom-fields/tags/6.8.11/
- https://wordpress.org/plugins/advanced-custom-fields/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2420/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.