Executive brief
Advanced Custom Fields is a popular WordPress plugin used to add custom data fields to websites. A security flaw allows unauthorized individuals to modify the title and content of existing website posts if those posts use a specific public form feature. This could lead to website defacement or the unauthorized alteration of public-facing information.
Technical details
The Advanced Custom Fields (ACF) plugin for WordPress suffers from a missing authorization check (CWE-862) in the acf_form() functionality. In versions up to and including 6.8.1, the plugin fails to properly validate user permissions during form submission. An unauthenticated remote attacker can exploit this by injecting '_post_title' and '_post_content' parameters into a request directed at a publicly accessible acf_form() instance. This allows the attacker to overwrite the original title and content of the associated post. A patch has been identified in the plugin's trunk repository.
Affected products
- WP Engine Advanced Custom Fields (ACF) Up to and including 6.8.1
Timeline
- 2026-05-31: disclosed: Initial disclosure by Wordfence and NVD publication.
- 2026-05-31: advisory
References
- https://plugins.trac.wordpress.org/browser/advanced-custom-fields/tags/6.8.0/includes/forms/form-front.php
- https://plugins.trac.wordpress.org/changeset/3549586/advanced-custom-fields/trunk/includes/forms/form-front.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/ddb2290d-d4bd-4f70-9fe9-927f49721811?source=cve