Skip to content
Sign in
2.7 Low

CVE-2026-97189 Advanced Custom Fields < 6.8.11 - Contributor+ Unpublished Post Title and Status Disclosure via Relational Fields

Description

The Advanced Custom Fields (ACF®) WordPress plugin before 6.8.11 does not perform a read-permission check when it renders and formats the values of its relational fields, allowing users with post-editing access (Contributor and above) to disclose the titles and non-public statuses of other users' unpublished posts.

CVSS 3.1 detail

Vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Exploitable remotely over the network, with an administrator account and without any user action; the impact on data or service is limited.

Attack vector
Network
Attack complexity
Low
Privileges required
High
Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None

Affected products and versions

Product Affected versions Fixed in
Advanced Custom Fields (ACF®) 6.8 earliest → < 6.8.11 6.8.11

Other CVEs of Advanced Custom Fields (ACF®)

The 4 CVEs of Advanced Custom Fields (ACF®) →
CVE-2026-97191 Advanced Custom Fields < 6.8.11 - Contributor+ Admin-Restricted Custom Field Update via Post Save Path 2.7 Low CVE-2026-97190 Advanced Custom Fields 6.2.0 - 6.8.10 - Contributor+ Relationship Field Update on Arbitrary Objects via IDOR 2.7 Low CVE-2026-110813 Advanced Custom Fields (ACF®) < 6.8.11 - Unauthenticated Stored XSS via HTML Attribute Name Injection 7.5 High
Track this CVE