CVE-2026-8382: Advanced Custom Fields (ACF®) <= 6.8.1 - Unauthenticated Arbitrary Post Modification via Front-End Form '_post_title' and '_post_content' Parameters
The Advanced Custom Fields (ACF®) plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.8.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to overwrite the posttitle and postcontent of any post bound to a publicly accessible acfform() instance by injecting values into the posttitle and postcontent parameters of a form submission request.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Do not expose publicly accessible acf_form() instances; ensure acf_form() forms are not available to unauthenticated users so attackers cannot submit _post_title and _post_content parameters.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-8382?
The severity of CVE-2026-8382 is classified as medium with a score of 5.3.
How do I fix CVE-2026-8382?
To fix CVE-2026-8382, update the Advanced Custom Fields plugin to version 6.8.2 or later.
What does CVE-2026-8382 affect?
CVE-2026-8382 affects all versions of the Advanced Custom Fields plugin for WordPress up to and including 6.8.1.
What kind of vulnerability is CVE-2026-8382?
CVE-2026-8382 is an authorization bypass vulnerability that allows unauthenticated attackers to perform arbitrary post modifications.
What parameters are exploited in CVE-2026-8382?
CVE-2026-8382 exploits the front-end form parameters '_post_title' and '_post_content' to modify posts.