Read the docs
TI-2026-86411 Aliases CVE-2026-97189GHSA-3r78-26qx-3q7m

Advanced Custom Fields: Contributor+ Sees Unpublished Post Titles

Priority LOW 13CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-200.

Summary

The Advanced Custom Fields (ACF®) WordPress plugin before 6.8.11 does not check read permissions when it renders and formats relational field values. Users with post-editing access, Contributor and above, can see the titles and non-public statuses of other users' unpublished posts. The weakness is CWE-200, Exposure of Sensitive Information to an Unauthorized Actor, with a CVSS 3.1 base score of 2.7 (LOW). CISA has not added it to KEV.

Written with Claude Haiku 5.5 from the sources below · 2026-11-07

Description from the CNA

The Advanced Custom Fields (ACF®) WordPress plugin before 6.8.11 does not perform a read-permission check when it renders and formats the values of its relational fields, allowing users with post-editing access (Contributor and above) to disclose the titles and non-public statuses of other users' unpublished posts.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0014 3rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed Advanced Custom Fields (ACF®) (Unknown): 6.8.11

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
UnknownAdvanced Custom Fields (ACF®)before 6.8.116.8.11Patch availableCNA
  • Advanced Custom Fields (ACF®) VendorUnknown Affected before 6.8.11 Fixed in 6.8.11 Patch available CNA

Remediation

Update Advanced Custom Fields (ACF®) to version 6.8.11 or later, which fixes the issue.

Written with Claude Haiku 5.5 from the sources below · 2026-11-07

  • Fix · CNA Advanced Custom Fields (ACF®) (Unknown) Fixed in 6.8.11

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Advanced Custom Fields (ACF®) 6.8.11

    3 records Highest priority Priority LOW 3 LOW

    Other records, highest priority first

    • TI-2026-86413 Advanced Custom Fields Improper Access Control in Post Save PathPriority LOW 13
    • TI-2026-86412 Authorization bypass in Advanced Custom Fields relationship updatesPriority LOW 13
    Show all 3 records →

Timeline

  1. 2026-11-07 Threatist record created from CVE-2026-97189
  2. 2026-11-07 Alias added: GHSA-3r78-26qx-3q7m
  3. 2026-11-07 CVSS score added · CISA ADP
  4. 2026-11-07 Weakness changed · CISA ADP
  5. 2026-11-07 CISA SSVC decision points changed

References

Exploit 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences