Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: Advanced Custom Fields (ACF®) 6.8.11 Clear all filters
TI-2026-86413 CVE-2026-97191 · GHSA-32f3-wpx7-chp4

Advanced Custom Fields Improper Access Control in Post Save Path

Priority LOW 13

The Advanced Custom Fields (ACF®) WordPress plugin before 6.8.11 does not re-apply its field-group location rules when persisting values submitted through the post editor save path, allowing users with contributor-level…

CVSS 3.1LOW 2.7 Network High privileges No interaction EPSS 0.00168 Published 2026-11-07 Fixed in 6.8.11 CWE-284
TI-2026-86412 CVE-2026-97190 · GHSA-rxjg-4wwx-r4pf

Authorization bypass in Advanced Custom Fields relationship updates

Priority LOW 13

The Advanced Custom Fields (ACF®) WordPress plugin before 6.8.11 does not verify that a user is allowed to edit the target object before writing to it during bidirectional relationship synchronization, allowing users wit…

CVSS 3.1LOW 2.7 Network High privileges No interaction EPSS 0.00168 Published 2026-11-07 Fixed in 6.8.11 CWE-639
TI-2026-86411 CVE-2026-97189 · GHSA-3r78-26qx-3q7m

Advanced Custom Fields: Contributor+ Sees Unpublished Post Titles

Priority LOW 13

The Advanced Custom Fields (ACF®) WordPress plugin before 6.8.11 does not perform a read-permission check when it renders and formats the values of its relational fields, allowing users with post-editing access (Contribu…

CVSS 3.1LOW 2.7 Network High privileges No interaction EPSS 0.00189 Published 2026-11-07 Fixed in 6.8.11 CWE-200