Skip to content
Sign in
2.7 Low

CVE-2026-97190 Advanced Custom Fields 6.2.0 - 6.8.10 - Contributor+ Relationship Field Update on Arbitrary Objects via IDOR

Description

The Advanced Custom Fields (ACF®) WordPress plugin before 6.8.11 does not verify that a user is allowed to edit the target object before writing to it during bidirectional relationship synchronization, allowing users with contributor-level access and above to add or remove a reference to their own object on arbitrary posts, users, or terms they cannot otherwise edit.

CVSS 3.1 detail

Vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

Exploitable remotely over the network, with an administrator account and without any user action; the impact on data or service is limited.

Attack vector
Network
Attack complexity
Low
Privileges required
High
Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None

Affected products and versions

Product Affected versions Fixed in
Advanced Custom Fields (ACF®) 6.2 6.2.0 → < 6.8.11 6.8.11

Other CVEs of Advanced Custom Fields (ACF®)

The 4 CVEs of Advanced Custom Fields (ACF®) →
CVE-2026-97191 Advanced Custom Fields < 6.8.11 - Contributor+ Admin-Restricted Custom Field Update via Post Save Path 2.7 Low CVE-2026-97189 Advanced Custom Fields < 6.8.11 - Contributor+ Unpublished Post Title and Status Disclosure via Relational Fields 2.7 Low CVE-2026-110813 Advanced Custom Fields (ACF®) < 6.8.11 - Unauthenticated Stored XSS via HTML Attribute Name Injection 7.5 High
Track this CVE