CVE-2026-97189 · Package
NO FIX YET · SEE WHAT TO DO
The Advanced Custom Fields WordPress plugin before 6.8.11 skips a read-permission check when it renders relational fields. A logged-in user with post-editing access, such as a Contributor, can see the titles and non-public statuses of other users' unpublished posts.
first public Nov 7, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Sites running the Advanced Custom Fields WordPress plugin before 6.8.11 that use relational fields and have multiple users with post-editing access, such as Contributors. Sites with only one editor, or without relational fields, have a smaller exposure. Sites on 6.8.11 or later are not affected.
Not affected if no-relational-fields, single-editor, version-6.8.11-or-later
Who cares advanced-custom-fields, self-hosted, wordpress
6.8.11 or later.The Advanced Custom Fields (ACF®) WordPress plugin before 6.8.11 does not perform a read-permission check when it renders and formats the values of its relational fields, allowing users with post-editing access (Contributor and above) to disclose the titles and non-public statuses of other users' unpublished posts.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.