Advanced Custom Fields (ACF), CVE-2026-8382

CVE, Research URL: CVE-2026-8382
Home page URL: Security reports for Advanced Custom Fields (ACF)
Application: Advanced Custom Fields (ACF)
Published on: May 31, 2026
Research Description: The Advanced Custom Fields (ACF®) plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.8.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to overwrite the post_title and post_content of any post bound to a publicly accessible acf_form() instance by injecting values into the _post_title and _post_content parameters of a form submission request.
Affected versions: max 6.8.2.
Status: vulnerable