CVE-2026-97191: Advanced Custom Fields < 6.8.11 - Contributor+ Admin-Restricted Custom Field Update via Post Save Path

Q: Who can exploit this issue?

A user with contributor-level access or higher can exploit it, provided they can save their own posts through the post editor.

Q: What is required for exploitation?

The site must use a vulnerable ACF version before 6.8.11 and have custom fields that are intended to be restricted to administrators through field-group location rules. The attacker submits values through the post editor save path.

Q: Are administrator-restricted fields exposed by default?

The issue affects fields whose access is restricted using ACF field-group location rules. The provided information does not establish whether any particular default ACF configuration includes such restricted fields.

Q: What can be done if updating is not immediately possible?

Limit contributor and other non-administrator users' ability to edit or save posts where administrator-restricted custom fields could be written. Review and remove unnecessary contributor-or-higher accounts.

Q: How can administrators identify possible impact?

Review posts created or edited by contributor-level and other non-administrator accounts for values in custom fields intended to be administrator-only. Focus on fields associated with field groups restricted by location rules.

Published Nov 7, 2026

Updated

The Advanced Custom Fields (ACF®) WordPress plugin before 6.8.11 does not re-apply its field-group location rules when persisting values submitted through the post editor save path, allowing users with contributor-level access and above to write custom fields the site restricted to administrators onto their own posts.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Advanced Custom Fields to a version that resolves this vulnerability.
Fixed in 6.8.11

Event History

Nov 7, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·06:16 AM

Description

Frequently Asked Questions

Who can exploit this issue?

A user with contributor-level access or higher can exploit it, provided they can save their own posts through the post editor.

What is required for exploitation?

The site must use a vulnerable ACF version before 6.8.11 and have custom fields that are intended to be restricted to administrators through field-group location rules. The attacker submits values through the post editor save path.

Are administrator-restricted fields exposed by default?

The issue affects fields whose access is restricted using ACF field-group location rules. The provided information does not establish whether any particular default ACF configuration includes such restricted fields.

What can be done if updating is not immediately possible?

Limit contributor and other non-administrator users' ability to edit or save posts where administrator-restricted custom fields could be written. Review and remove unnecessary contributor-or-higher accounts.

How can administrators identify possible impact?

Review posts created or edited by contributor-level and other non-administrator accounts for values in custom fields intended to be administrator-only. Focus on fields associated with field groups restricted by location rules.

CVE-2026-97191: Advanced Custom Fields < 6.8.11 - Contributor+ Admin-Restricted Custom Field Update via Post Save Path

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What is required for exploitation?

Are administrator-restricted fields exposed by default?

What can be done if updating is not immediately possible?

How can administrators identify possible impact?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What is required for exploitation?

Are administrator-restricted fields exposed by default?

What can be done if updating is not immediately possible?

How can administrators identify possible impact?