Skip to content
Sign in
2.7 Low

CVE-2026-97191 Advanced Custom Fields < 6.8.11 - Contributor+ Admin-Restricted Custom Field Update via Post Save Path

Description

The Advanced Custom Fields (ACF®) WordPress plugin before 6.8.11 does not re-apply its field-group location rules when persisting values submitted through the post editor save path, allowing users with contributor-level access and above to write custom fields the site restricted to administrators onto their own posts.

CVSS 3.1 detail

Vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

Exploitable remotely over the network, with an administrator account and without any user action; the impact on data or service is limited.

Attack vector
Network
Attack complexity
Low
Privileges required
High
Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None

Affected products and versions

Product Affected versions Fixed in
Advanced Custom Fields (ACF®) 6.8 earliest → < 6.8.11 6.8.11

Other CVEs of Advanced Custom Fields (ACF®)

The 4 CVEs of Advanced Custom Fields (ACF®) →
CVE-2026-97190 Advanced Custom Fields 6.2.0 - 6.8.10 - Contributor+ Relationship Field Update on Arbitrary Objects via IDOR 2.7 Low CVE-2026-97189 Advanced Custom Fields < 6.8.11 - Contributor+ Unpublished Post Title and Status Disclosure via Relational Fields 2.7 Low CVE-2026-110813 Advanced Custom Fields (ACF®) < 6.8.11 - Unauthenticated Stored XSS via HTML Attribute Name Injection 7.5 High
Track this CVE