Plugins · advanced-custom-fields · data as of 2026-11-01
Is Advanced Custom Fields (ACF®) safe? Known vulnerabilities and latest version
- Latest version
- 6.8.10
- Last updated
- 2026-09-10
- Active installs
- 2+ million
- Known issues on record
- 14
- Unpatched in latest
- 0
- Tested up to WP
- 7.1.4 · PHP 7.4+
ACF helps customize WordPress with powerful, professional and intuitive fields. Proudly powering over 2 million sites, WordPress developers love ACF. — by WP Engine
What to do
- Update to the latest version (6.8.10). Anything older than 6.8.2 has at least one known issue listed below. Dashboard → Updates, or Plugins → “update now”.
- If you cannot update right away, deactivate it until you can.
- Turn on auto-updates for it: Plugins → “Enable auto-updates” on its row.
- If you ran a vulnerable version and something looks off (spam pages, strange admins, redirects), run the free scan.
With WP-CLI: wp plugin get advanced-custom-fields --field=version shows what you run; wp plugin update advanced-custom-fields updates it.
Check your version
Known vulnerabilities
14 on record, newest first. “Affected” is the version range the source gives; “fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version.
medium 5.3 CVE-2026-8382 · published 2026-05-31
Missing authorization check in Advanced Custom Fields (ACF®) (6.8.1 and older)
- Affected
- 6.8.1 and older
- Fixed in
- 6.8.2 *
- Access needed (per CVSS)
- No login needed
- Range from
- CVE record (the advisory publisher) · score by Wordfence
Details from the advisory
The Advanced Custom Fields (ACF®) plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.8.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to overwrite the post_title and post_content of any post bound to a publicly accessible acf_form() instance by injecting values into the _post_title and _post_content parameters of a form submission request.
NVD CVE-2026-8382Wordfence advisoryCode change (fix)Plugin source
medium 5.3 CVE-2026-4812 · published 2026-04-15
Missing authorization check in Advanced Custom Fields (ACF®) (6.7.0 and older)
- Affected
- 6.7.0 and older
- Fixed in
- 6.7.1 *
- Access needed (per CVSS)
- No login needed
- Range from
- CVE record (the advisory publisher) · score by Wordfence
Details from the advisory
The Advanced Custom Fields (ACF) plugin for WordPress is vulnerable to Missing Authorization to Arbitrary Post/Page Disclosure in versions up to and including 6.7.0. This is due to AJAX field query endpoints accepting user-supplied filter parameters that override field-configured restrictions without proper authorization checks. This makes it possible for unauthenticated attackers with access to a frontend ACF form to enumerate and disclose information about draft/private posts, restricted post types, and other data that should be restricted by field configuration.
medium 6.1 CVE-2024-45429 · published 2024-09-04
Cross-site scripting (XSS) in Advanced Custom Fields (ACF®) (6.3.5 and older)
- Affected
- 6.3.5 and older
- Fixed in
- 6.3.6 *
- Access needed (per CVSS)
- No login needed; someone on the site has to click a link or open a page
- Range from
- NVD analysis · score by NVD
Details from the advisory
Cross-site scripting vulnerability exists in Advanced Custom Fields versions 6.3.5 and earlier and Advanced Custom Fields Pro versions 6.3.5 and earlier. If an attacker with the 'capability' setting privilege which is set in the product settings stores an arbitrary script in the field label, the script may be executed on the web browser of the logged-in user with the same privilege as the attacker's.
NVD CVE-2024-45429wordpress.orgjvn.jpadvancedcustomfields.comadvancedcustomfields.com
medium 6.5 CVE-2024-4565 · published 2024-06-20
Security issue in Advanced Custom Fields (ACF®) (older than 6.3)
- Affected
- older than 6.3
- Fixed in
- 6.3
- Access needed (per CVSS)
- Needs a low-level account (e.g. subscriber)
- Range from
- CVE record (the advisory publisher) · score by NVD
Details from the advisory
The Advanced Custom Fields (ACF) WordPress plugin before 6.3, Advanced Custom Fields Pro WordPress plugin before 6.3 allows you to display custom field values for any post via shortcode without checking for the correct access
medium 5.4 CVE-2023-6701 · published 2024-02-05
Stored cross-site scripting (XSS) in Advanced Custom Fields (ACF®) (6.2.4 and older)
- Affected
- 6.2.4 and older
- Fixed in
- 6.2.5 *
- Access needed (per CVSS)
- Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
- Range from
- CVE record (the advisory publisher) · score by NVD
Details from the advisory
The Advanced Custom Fields (ACF) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a custom text field in all versions up to, and including, 6.2.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
NVD CVE-2023-6701Wordfence advisoryCode change (fix)advancedcustomfields.com
high 7.5 CVE-2022-40696 · published 2024-01-08
Information disclosure in Advanced Custom Fields (ACF®) (3.1.1 to 6.0.2)
- Affected
- 3.1.1 to 6.0.2
- Fixed in
- 6.0.3
- Access needed (per CVSS)
- No login needed
- Range from
- CVE record (the advisory publisher) · score by NVD
Details from the advisory
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in WP Engine Advanced Custom Fields (ACF).This issue affects Advanced Custom Fields (ACF): from 3.1.1 through 6.0.2.
medium 5.4 CVE-2023-40068 · published 2023-08-21
Cross-site scripting (XSS) in Advanced Custom Fields (ACF®) (6.1.0 to 6.1.7)
- Affected
- 6.1.0 to 6.1.7
- Fixed in
- 6.1.8 *
- Access needed (per CVSS)
- Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
- Range from
- NVD analysis · score by NVD
Details from the advisory
Cross-site scripting vulnerability in Advanced Custom Fields versions 6.1.0 to 6.1.7 and Advanced Custom Fields Pro versions 6.1.0 to 6.1.7 allows a remote authenticated attacker to execute an arbitrary script on the web browser of the user who is logging in to the product with the administrative privilege.
NVD CVE-2023-40068wordpress.orgjvn.jpadvancedcustomfields.comadvancedcustomfields.com
high 8.8 CVE-2023-1196 · published 2023-05-02
PHP object injection in Advanced Custom Fields (ACF®) (5.0.0 up to (not including) 5.12.5, 6.0.0 up to (not including) 6.1.0)
- Affected
- 5.0.0 up to (not including) 5.12.5, 6.0.0 up to (not including) 6.1.0
- Fixed in
- 6.1.0
- Access needed (per CVSS)
- Needs a low-level account (e.g. subscriber)
- Range from
- CVE record (the advisory publisher) · score by NVD
Details from the advisory
The Advanced Custom Fields (ACF) Free and Pro WordPress plugins 6.x before 6.1.0 and 5.x before 5.12.5 unserialize user controllable data, which could allow users with a role of Contributor and above to perform PHP Object Injection when a suitable gadget is present.
medium 6.5 CVE-2022-23183 · published 2022-03-31
Missing authorization check in Advanced Custom Fields (ACF®) (older than 5.12.1)
- Affected
- older than 5.12.1
- Fixed in
- 5.12.1
- Access needed (per CVSS)
- Needs a low-level account (e.g. subscriber)
- Range from
- NVD analysis · score by NVD
Details from the advisory
Missing authorization vulnerability in Advanced Custom Fields versions prior to 5.12.1 and Advanced Custom Fields Pro versions prior to 5.12.1 allows a remote authenticated attacker to view the information on the database without the access permission.
NVD CVE-2022-23183wordpress.orgjvn.jpadvancedcustomfields.com
medium 6.5 CVE-2021-20867 · published 2021-12-13
Missing authorization check in Advanced Custom Fields (ACF®) (older than 5.11)
- Affected
- older than 5.11
- Fixed in
- 5.11
- Access needed (per CVSS)
- Needs a low-level account (e.g. subscriber)
- Range from
- NVD analysis · score by NVD
Details from the advisory
Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing authorization vulnerability in moving the field group which may allow a user to move the unauthorized field group via unspecified vectors.
NVD CVE-2021-20867wordpress.orgjvn.jpadvancedcustomfields.com
high 7.5 CVE-2021-20865 · published 2021-12-13
Missing authorization check in Advanced Custom Fields (ACF®) (older than 5.11)
- Affected
- older than 5.11
- Fixed in
- 5.11
- Access needed (per CVSS)
- No login needed
- Range from
- NVD analysis · score by NVD
Details from the advisory
Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing authorization vulnerability in browsing database which may allow a user to browse unauthorized data via unspecified vectors.
NVD CVE-2021-20865wordpress.orgjvn.jpadvancedcustomfields.com
medium 6.5 CVE-2021-20866 · published 2021-12-13
Missing authorization check in Advanced Custom Fields (ACF®) (older than 5.11)
- Affected
- older than 5.11
- Fixed in
- 5.11
- Access needed (per CVSS)
- Needs a low-level account (e.g. subscriber)
- Range from
- NVD analysis · score by NVD
Details from the advisory
Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing authorization vulnerability in obtaining the user list which may allow a user to obtain the unauthorized information via unspecified vectors.
NVD CVE-2021-20866wordpress.orgjvn.jpadvancedcustomfields.com
medium 6.1 CVE-2020-36172 · published 2021-01-06
Cross-site scripting (XSS) in Advanced Custom Fields (ACF®) (older than 5.8.12)
- Affected
- older than 5.8.12
- Fixed in
- 5.8.12
- Access needed (per CVSS)
- No login needed; someone on the site has to click a link or open a page
- Range from
- NVD analysis · score by NVD
Details from the advisory
The Advanced Custom Fields plugin before 5.8.12 for WordPress mishandles the escaping of strings in Select2 dropdowns, potentially leading to XSS.
medium 5.4 CVE-2018-20986 · published 2019-08-22
Cross-site scripting (XSS) in Advanced Custom Fields (ACF®) (older than 5.7.8)
- Affected
- older than 5.7.8
- Fixed in
- 5.7.8
- Access needed (per CVSS)
- Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
- Range from
- NVD analysis · score by NVD
Details from the advisory
The advanced-custom-fields (aka Elliot Condon Advanced Custom Fields) plugin before 5.7.8 for WordPress has XSS by authors.
NVD CVE-2018-20986wordpress.orgadvancedcustomfields.comadvancedcustomfields.comwww2.deloitte.com
Recent activity
- 2026-09-10 — latest release on wordpress.org (6.8.10).
- 2026-05-31 — Missing authorization check disclosed (CVE-2026-8382), fixed in 6.8.2.
- 2026-04-15 — Missing authorization check disclosed (CVE-2026-4812), fixed in 6.7.1.
- 2024-09-04 — Cross-site scripting (XSS) disclosed (CVE-2024-45429), fixed in 6.3.6.
Get an email when Advanced Custom Fields (ACF®) has a new vulnerability
Free. We check the CVE feeds every day and email you only when a new issue for Advanced Custom Fields (ACF®) (advanced-custom-fields) is published or a fix ships. Unsubscribe in one click.
Where this data comes from
- Version, last update, installs: wordpress.org/plugins/advanced-custom-fields (Plugins API), fetched 2026-11-01.
- Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-01. This product uses data from the NVD API but is not endorsed or certified by the NVD.
- Each record links to its CVE page and to the original advisory (Wordfence, Patchstack or WPScan) where there is one. We only list a CVE here when its references or its advisory name this exact plugin, so a few real issues may be missing; none should be about a different plugin. Spot an error? Email Daniel.
Badge for your site or docs (states facts with a date, not a verdict):
<a href="https://laskyr.com/plugins/advanced-custom-fields"><img src="https://laskyr.com/plugins/advanced-custom-fields/badge.svg" alt="Advanced Custom Fields (ACF®) vulnerability status"></a>