{"id":"CVE-2026-97189","kind":"vulnerability","aliases":["CVE-2026-97189"],"related":[],"title":"WordPress ACF plugin: contributors can read titles of others' unpublished posts","description":"The Advanced Custom Fields (ACF®) WordPress plugin before 6.8.11 does not perform a read-permission check when it renders and formats the values of its relational fields, allowing users with post-editing access (Contributor and above) to disclose the titles and non-public statuses of other users' unpublished posts.","summary":"The Advanced Custom Fields WordPress plugin before 6.8.11 skips a read-permission check when it renders relational fields. A logged-in user with post-editing access, such as a Contributor, can see the titles and non-public statuses of other users' unpublished posts.","severity":"low","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["advanced-custom-fields","package","self-hosted","wordpress"],"not_affected_if":["no-relational-fields","single-editor","version-6.8.11-or-later"],"how_to_check":"- Check the installed Advanced Custom Fields plugin version in the WordPress admin under Plugins.\n- Confirm whether the site uses relational fields (Post Object, Relationship, or similar) in ACF field groups.","fix":"- Advanced Custom Fields (WordPress plugin): move to `6.8.11` or later.","status":"open","published_at":"2026-11-07T06:16:59+00:00","first_seen_at":"2026-11-07T06:46:04+00:00","triaged_at":"2026-11-07T06:48:13+00:00","updated_at":"2026-11-07T06:48:13+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-07T06:48:13Z","model":"claude-haiku-5-5","output":{"fix":"- Advanced Custom Fields (WordPress plugin): move to `6.8.11` or later.","reach":"network","title":"WordPress ACF plugin: contributors can read titles of others' unpublished posts","impact":"low","summary":"The Advanced Custom Fields WordPress plugin before 6.8.11 skips a read-permission check when it renders relational fields. A logged-in user with post-editing access, such as a Contributor, can see the titles and non-public statuses of other users' unpublished posts.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","advanced-custom-fields","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Contributors read titles and statuses of others' unpublished posts","analyst_note":"","how_to_check":"- Check the installed Advanced Custom Fields plugin version in the WordPress admin under Plugins.\n- Confirm whether the site uses relational fields (Post Object, Relationship, or similar) in ACF field groups.","plain_action":"","needs_analyst":false,"not_affected_if":["version-6.8.11-or-later","no-relational-fields","single-editor"],"who_is_affected":"Sites running the Advanced Custom Fields WordPress plugin before 6.8.11 that use relational fields and have multiple users with post-editing access, such as Contributors. Sites with only one editor, or without relational fields, have a smaller exposure. Sites on 6.8.11 or later are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000705,"input_tokens":4226,"output_tokens":564,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-97189':14A,17A '6.8.11':34B,82C 'access':55B,108C 'acf':2A,78C 'advanc':19B,28B,75C 'advanced-custom-field':18B 'allow':102C 'check':40B,90C 'contributor':4A,59B,109C 'custom':20B,29B,76C 'cve':12A,15A 'disclos':113C 'edit':54B,107C 'field':21B,30B,45B,77C,101C 'format':95C 'host':25B 'log':48B 'logged-in':47B 'non':66B,118C 'non-publ':65B,117C 'other':9A 'packag':22B 'perform':85C 'permiss':39B,89C 'plugin':3A,32B,80C 'post':11A,53B,73B,106C,125C 'post-edit':52B,105C 'public':67B,119C 'read':6A,38B,88C 'read-permiss':37B,87C 'relat':44B,100C 'render':43B,93C 'see':61B 'self':24B 'self-host':23B 'skip':35B 'status':68B,120C 'titl':7A,63B,115C 'unpublish':10A,72B,124C 'user':50B,71B,103C,123C 'valu':97C 'wordpress':1A,26B,31B,79C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Advanced Custom Fields WordPress plugin before 6.8.11 that use relational fields and have multiple users with post-editing access, such as Contributors. Sites with only one editor, or without relational fields, have a smaller exposure. Sites on 6.8.11 or later are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["advancedcustomfields","low","package","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-2026':13A,16A '-97189':14A,17A 'acf':2A 'contributor':4A 'cve':12A,15A 'other':9A 'plugin':3A 'post':11A 'read':6A 'titl':7A 'unpublish':10A 'wordpress':1A","search_b":"'6.8.11':34B 'access':55B 'advanc':19B,28B 'advanced-custom-field':18B 'check':40B 'contributor':59B 'custom':20B,29B 'edit':54B 'field':21B,30B,45B 'host':25B 'log':48B 'logged-in':47B 'non':66B 'non-publ':65B 'packag':22B 'permiss':39B 'plugin':32B 'post':53B,73B 'post-edit':52B 'public':67B 'read':38B 'read-permiss':37B 'relat':44B 'render':43B 'see':61B 'self':24B 'self-host':23B 'skip':35B 'status':68B 'titl':63B 'unpublish':72B 'user':50B,71B 'wordpress':26B,31B","search_c":"'6.8.11':82C 'access':108C 'acf':78C 'advanc':75C 'allow':102C 'check':90C 'contributor':109C 'custom':76C 'disclos':113C 'edit':107C 'field':77C,101C 'format':95C 'non':118C 'non-publ':117C 'perform':85C 'permiss':89C 'plugin':80C 'post':106C,125C 'post-edit':105C 'public':119C 'read':88C 'read-permiss':87C 'relat':100C 'render':93C 'status':120C 'titl':115C 'unpublish':124C 'user':103C,123C 'valu':97C 'wordpress':79C","first_public_at":"2026-11-07T06:16:59+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-97189","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97189","severity":null,"published_at":"2026-11-07T06:16:59+00:00","modified_at":"2026-11-07T06:16:59+00:00","first_seen_at":"2026-11-07T06:46:04+00:00","fetched_at":"2026-11-07T06:46:04+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}