CVE-2026-97191 · Package
NO FIX YET · SEE WHAT TO DO
The Advanced Custom Fields WordPress plugin before 6.8.11 does not re-check its field-group location rules when saving values from the post editor. A contributor-level user can therefore write custom fields that the site limited to administrators onto their own posts.
first public Nov 7, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Sites running the Advanced Custom Fields plugin below 6.8.11 where contributor-level or higher users can edit posts. Sites that only have administrators as post editors have a smaller exposure. The sources do not describe specific field types or configurations beyond the location-rule restriction.
Not affected if advanced-custom-fields-6.8.11-or-later, no-contributor-accounts
Who cares advanced-custom-fields, self-hosted, wordpress
wp plugin get advanced-custom-fields --field=version6.8.11 or later (per the advisory summary; confirm against the NVD entry)The Advanced Custom Fields (ACF®) WordPress plugin before 6.8.11 does not re-apply its field-group location rules when persisting values submitted through the post editor save path, allowing users with contributor-level access and above to write custom fields the site restricted to administrators onto their own posts.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.