CVE-2026-97189: Advanced Custom Fields < 6.8.11 - Contributor+ Unpublished Post Title and Status Disclosure via Relational Fields

Q: Who can exploit this issue?

A user with post-editing access can exploit it. The affected roles explicitly include Contributors and higher-privileged users.

Q: What information can be disclosed?

An attacker can disclose titles and non-public publication statuses of unpublished posts owned by other users.

Q: What must be present for exploitation?

The issue occurs when ACF renders and formats values from its relational fields. The vulnerable behavior is the lack of a read-permission check during that process.

Q: Which versions are affected?

Advanced Custom Fields versions before 6.8.11 are affected.

Published Nov 7, 2026

Updated

The Advanced Custom Fields (ACF®) WordPress plugin before 6.8.11 does not perform a read-permission check when it renders and formats the values of its relational fields, allowing users with post-editing access (Contributor and above) to disclose the titles and non-public statuses of other users' unpublished posts.

Event History

Nov 7, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·06:16 AM

Description

Frequently Asked Questions

Who can exploit this issue?

A user with post-editing access can exploit it. The affected roles explicitly include Contributors and higher-privileged users.

What information can be disclosed?

An attacker can disclose titles and non-public publication statuses of unpublished posts owned by other users.

What must be present for exploitation?

The issue occurs when ACF renders and formats values from its relational fields. The vulnerable behavior is the lack of a read-permission check during that process.

Which versions are affected?

Advanced Custom Fields versions before 6.8.11 are affected.

CVE-2026-97189: Advanced Custom Fields < 6.8.11 - Contributor+ Unpublished Post Title and Status Disclosure via Relational Fields

Event History

Frequently Asked Questions

Who can exploit this issue?

What information can be disclosed?

What must be present for exploitation?

Which versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What information can be disclosed?

What must be present for exploitation?

Which versions are affected?