Vulnerabilities / Advanced Custom Fields (ACF®)
Advanced Custom Fields (ACF®) vulnerabilities
Advisories WPSec published for Advanced Custom Fields (ACF®). Other sources may list more. Its attack surface: Advanced Custom Fields (ACF®) on WPSec AttackSurface.
| Published | ID | Vulnerability | Severity | Fixed in |
|---|---|---|---|---|
| 2026-11-03 | WPSEC-2026-2423 | Advanced Custom Fields (ACF®) <= 6.8.10 - Unauthenticated Sensitive Information Exposure via Password-Protected Post Field Values | Medium 5.3 | 6.8.11 |
| 2026-11-03 | WPSEC-2026-2422 | Advanced Custom Fields (ACF®) <= 6.8.10 - Authenticated (Subscriber+) Sensitive Information Exposure via Relational Field Search | Medium 4.3 | 6.8.11 |
| 2026-11-03 | WPSEC-2026-2421 | Advanced Custom Fields (ACF®) <= 6.8.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Field Wrapper Attributes and Custom Choice Values | Medium 4.9 | 6.8.11 |
| 2026-11-03 | WPSEC-2026-2420 | Advanced Custom Fields (ACF®) <= 6.8.10 - Authenticated (Contributor+) Missing Authorization to Unrendered Field Value Update | Medium 4.3 | 6.8.11 |
| 2026-11-03 | WPSEC-2026-2419 | Advanced Custom Fields (ACF®) <= 6.8.10 - Authenticated (Contributor+) Missing Authorization to Bidirectional Relationship Modification | Medium 4.3 | 6.8.11 |
License: CC BY 4.0