CVE-2026-97190: Advanced Custom Fields 6.2.0 - 6.8.10 - Contributor+ Relationship Field Update on Arbitrary Objects via IDOR

Published Nov 7, 2026

Updated

The Advanced Custom Fields (ACF®) WordPress plugin before 6.8.11 does not verify that a user is allowed to edit the target object before writing to it during bidirectional relationship synchronization, allowing users with contributor-level access and above to add or remove a reference to their own object on arbitrary posts, users, or terms they cannot otherwise edit.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Advanced Custom Fields to a version that resolves this vulnerability.
Fixed in 6.8.11

Event History

Nov 7, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·06:16 AM

Description

Frequently Asked Questions

Who can exploit this issue?

Any authenticated WordPress user with contributor-level access or higher can exploit it. The vulnerable behavior is present when bidirectional relationship synchronization is used.

What access does an attacker need to modify another object?

The attacker needs an account that can edit their own object and can trigger a bidirectional relationship update. They do not need permission to edit the target post, user, or term.

What can an attacker change?

They can add or remove a reference to their own object on arbitrary posts, users, or terms that they would not otherwise be allowed to edit. The described impact is limited to relationship references written during bidirectional synchronization.

Which versions should be remediated?

Advanced Custom Fields versions before 6.8.11 are affected. Update to 6.8.11 or later.

What can be done if updating is delayed?

Restrict contributor-level and higher access to trusted users, particularly accounts able to edit objects that use bidirectional relationship fields. Review relationship-field changes involving posts, users, and terms for unauthorized references to lower-privileged users' objects.

CVE-2026-97190: Advanced Custom Fields 6.2.0 - 6.8.10 - Contributor+ Relationship Field Update on Arbitrary Objects via IDOR

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What access does an attacker need to modify another object?

What can an attacker change?

Which versions should be remediated?

What can be done if updating is delayed?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What access does an attacker need to modify another object?

What can an attacker change?

Which versions should be remediated?

What can be done if updating is delayed?