Advanced Custom Fields (ACF), PSC-2026-64613

PSC, Research URL: PSC-2026-64613
Home page URL: Security reports for Advanced Custom Fields (ACF)
Application: Advanced Custom Fields (ACF)
Published on: Feb 23, 2026
Research Description: Custom fields unlock a lot of power in WordPress, but they also expand the attack surface because they sit directly on the boundary between admin-side content modeling and front-end rendering. Field values can end up inside templates, blocks, REST responses, and admin UIs, which means weaknesses here frequently translate into stored XSS, unauthorized data exposure, or integrity issues. Advanced Custom Fields (ACF®) version 6.7.0 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-64613, confirming that the plugin was reviewed from a secure code perspective with attention to the most common exploitation paths for content modeling plugins.
Affected versions: Min 6.7.2, max 6.7.2.
Status: SAFE & CERTIFIED