{"id":"CVE-2026-97191","kind":"vulnerability","aliases":["CVE-2026-97191"],"related":[],"title":"WordPress ACF plugin lets contributors write admin-only custom fields","description":"The Advanced Custom Fields (ACF®) WordPress plugin before 6.8.11 does not re-apply its field-group location rules when persisting values submitted through the post editor save path, allowing users with contributor-level access and above to write custom fields the site restricted to administrators onto their own posts.","summary":"The Advanced Custom Fields WordPress plugin before 6.8.11 does not re-check its field-group location rules when saving values from the post editor. A contributor-level user can therefore write custom fields that the site limited to administrators onto their own posts.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["advanced-custom-fields","package","self-hosted","wordpress"],"not_affected_if":["advanced-custom-fields-6.8.11-or-later","no-contributor-accounts"],"how_to_check":"- Check the installed ACF version in the WordPress admin plugins list, or with `wp plugin get advanced-custom-fields --field=version`\n- Check whether any contributor-level or higher accounts can edit posts on the site","fix":"- Advanced Custom Fields: `6.8.11` or later (per the advisory summary; confirm against the NVD entry)","status":"open","published_at":"2026-11-07T06:16:59+00:00","first_seen_at":"2026-11-07T06:46:04+00:00","triaged_at":"2026-11-07T06:48:14+00:00","updated_at":"2026-11-07T06:48:14+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-07T06:48:14Z","model":"claude-haiku-5-5","output":{"fix":"- Advanced Custom Fields: `6.8.11` or later (per the advisory summary; confirm against the NVD entry)","reach":"internet","title":"WordPress ACF plugin lets contributors write admin-only custom fields","impact":"medium","summary":"The Advanced Custom Fields WordPress plugin before 6.8.11 does not re-check its field-group location rules when saving values from the post editor. A contributor-level user can therefore write custom fields that the site limited to administrators onto their own posts.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","advanced-custom-fields","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"Contributor writes admin-restricted custom fields onto their own posts","analyst_note":"Confirm the fixed version and affected range against the NVD entry and the plugin changelog; the sources only give 'before 6.8.11'.","how_to_check":"- Check the installed ACF version in the WordPress admin plugins list, or with `wp plugin get advanced-custom-fields --field=version`\n- Check whether any contributor-level or higher accounts can edit posts on the site","plain_action":"","needs_analyst":true,"not_affected_if":["advanced-custom-fields-6.8.11-or-later","no-contributor-accounts"],"who_is_affected":"Sites running the Advanced Custom Fields plugin below 6.8.11 where contributor-level or higher users can edit posts. Sites that only have administrators as post editors have a smaller exposure. The sources do not describe specific field types or configurations beyond the location-rule restriction.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000727,"input_tokens":4222,"output_tokens":609,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-97191':14A,17A '6.8.11':34B,81C 'access':109C 'acf':2A,77C 'admin':8A 'admin-on':7A 'administr':68B,120C 'advanc':19B,28B,74C 'advanced-custom-field':18B 'allow':103C 'appli':86C 'check':39B 'contributor':5A,55B,107C 'contributor-level':54B,106C 'custom':10A,20B,29B,61B,75C,114C 'cve':12A,15A 'editor':52B,100C 'field':11A,21B,30B,42B,62B,76C,89C,115C 'field-group':41B,88C 'group':43B,90C 'host':25B 'let':4A 'level':56B,108C 'limit':66B 'locat':44B,91C 'onto':69B,121C 'packag':22B 'path':102C 'persist':94C 'plugin':3A,32B,79C 'post':51B,72B,99C,124C 're':38B,85C 're-appli':84C 're-check':37B 'restrict':118C 'rule':45B,92C 'save':47B,101C 'self':24B 'self-host':23B 'site':65B,117C 'submit':96C 'therefor':59B 'user':57B,104C 'valu':48B,95C 'wordpress':1A,26B,31B,78C 'write':6A,60B,113C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Advanced Custom Fields plugin below 6.8.11 where contributor-level or higher users can edit posts. Sites that only have administrators as post editors have a smaller exposure. The sources do not describe specific field types or configurations beyond the location-rule restriction.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["advancedcustomfields","medium","package","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-2026':13A,16A '-97191':14A,17A 'acf':2A 'admin':8A 'admin-on':7A 'contributor':5A 'custom':10A 'cve':12A,15A 'field':11A 'let':4A 'plugin':3A 'wordpress':1A 'write':6A","search_b":"'6.8.11':34B 'administr':68B 'advanc':19B,28B 'advanced-custom-field':18B 'check':39B 'contributor':55B 'contributor-level':54B 'custom':20B,29B,61B 'editor':52B 'field':21B,30B,42B,62B 'field-group':41B 'group':43B 'host':25B 'level':56B 'limit':66B 'locat':44B 'onto':69B 'packag':22B 'plugin':32B 'post':51B,72B 're':38B 're-check':37B 'rule':45B 'save':47B 'self':24B 'self-host':23B 'site':65B 'therefor':59B 'user':57B 'valu':48B 'wordpress':26B,31B 'write':60B","search_c":"'6.8.11':81C 'access':109C 'acf':77C 'administr':120C 'advanc':74C 'allow':103C 'appli':86C 'contributor':107C 'contributor-level':106C 'custom':75C,114C 'editor':100C 'field':76C,89C,115C 'field-group':88C 'group':90C 'level':108C 'locat':91C 'onto':121C 'path':102C 'persist':94C 'plugin':79C 'post':99C,124C 're':85C 're-appli':84C 'restrict':118C 'rule':92C 'save':101C 'site':117C 'submit':96C 'user':104C 'valu':95C 'wordpress':78C 'write':113C","first_public_at":"2026-11-07T06:16:59+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-97191","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97191","severity":null,"published_at":"2026-11-07T06:16:59+00:00","modified_at":"2026-11-07T06:16:59+00:00","first_seen_at":"2026-11-07T06:46:04+00:00","fetched_at":"2026-11-07T06:46:04+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}