Authorization Bypass in Advanced Custom Fields Plugin for WordPress

CVE-2026-8382

What is CVE-2026-8382?

The Advanced Custom Fields (ACF) plugin for WordPress allows unauthenticated users to bypass authorization checks, which enables them to manipulate the content of posts. This vulnerability affects all versions up to and including 6.8.1. Attackers can exploit this flaw by injecting malicious values into the _post_title and _post_content parameters within form submissions, thereby compromising the integrity of publicly accessible ACF forms and altering post content without proper authorization.

References