# CVE-2026-97191: Advanced Custom Fields privilege escalation in post editor

Source: https://junglewise.ai/threats/cve-2026-97191-the-advanced-custom-fields-acf-wordpress-plugin-before-6-8-11  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-07. Updated: 2026-11-07  
License: CC BY 4.0 with a link back

CVE-2026-97191 · Severity: info · Published 2026-11-07

Advanced Custom Fields is a WordPress plugin that allows site administrators to create and manage custom data fields. A vulnerability allows contributor-level users to modify custom fields that site administrators have restricted to administrator access only, by submitting values through the post editor. This allows lower-privileged users to escalate their capabilities and modify sensitive custom data on their own posts.

Technologies: [Advanced Custom Fields](https://junglewise.ai/threats/technologies/advanced-custom-fields-advanced-custom-fields). Vendors: [Advanced Custom Fields](https://junglewise.ai/threats/vendors/advanced-custom-fields).

## Quick answers

**Is CVE-2026-97191 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-97191 being exploited in the wild.

**How severe is CVE-2026-97191?** Informational severity, published 7 November 2026.

**Which products and versions are affected?** Advanced Custom Fields before 6.8.11.

**Is there a fix for CVE-2026-97191?** Yes: fixed in 6.8.11. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-97191 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-97191?** Check whether you run Advanced Custom Fields at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 6.8.11

## Technical details

The plugin fails to re-validate field-group location rules during the post save operation, allowing contributors and above to bypass administrative access controls on custom fields. An attacker with contributor-level WordPress access can craft a post save request containing restricted custom field values, which persist without permission checks. The vulnerability exists in the post editor save path and affects versions before 6.8.11.

## Affected products

- Advanced Custom Fields Advanced Custom Fields before 6.8.11

## Timeline

- 2026-11-04: disclosed
- 2026-11-07: advisory

## References

- [https://wpscan.com/vulnerability/3eb847d4-6649-4f71-8dc7-e739a6317409/](https://wpscan.com/vulnerability/3eb847d4-6649-4f71-8dc7-e739a6317409/)

## Related threats

- [Advanced Custom Fields WordPress plugin information disclosure in relational fields](https://junglewise.ai/threats/cve-2026-97189-the-advanced-custom-fields-acf-wordpress-plugin-before-6-8-11)
- [Advanced Custom Fields unauthenticated stored XSS via HTML attribute injection](https://junglewise.ai/threats/cve-2026-110813-the-advanced-custom-fields-acf-wordpress-plugin-before-6-8-11)