CVE-2026-97190 in Advanced Custom Fields Plugin
Summary
by MITRE • 11/07/2026
The Advanced Custom Fields (ACF®) WordPress plugin before 6.8.11 does not verify that a user is allowed to edit the target object before writing to it during bidirectional relationship synchronization, allowing users with contributor-level access and above to add or remove a reference to their own object on arbitrary posts, users, or terms they cannot otherwise edit.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 11/07/2026
The vulnerability identified in Advanced Custom Fields (ACF) prior to version 6.8.11 represents a critical failure in server-side authorization logic within the plugin's bidirectional relationship synchronization mechanism. This flaw stems from an insufficient verification of user permissions during the process of updating related objects. Specifically, when ACF attempts to maintain consistency between two linked fields by writing data back to the source object after changes are made to the target object, it fails to validate whether the initiating user possesses the necessary capabilities to modify that specific source entity. This oversight allows an attacker with relatively low-privilege accounts, such as those at the contributor level or higher, to bypass standard WordPress permission checks and manipulate data structures they should not have access to alter.
From a technical perspective, this issue is classified under CWE-269, which denotes Improper Privilege Control. The root cause lies in the application logic where the bidirectional sync feature operates without re-evaluating the current user's role against the capabilities required for the target post type, user profile, or taxonomy term being modified. In a secure implementation, any write operation to an object must be preceded by a rigorous check ensuring that the actor has explicit permission to edit that specific resource. The absence of this check means that the integrity of the data model is compromised, as users can inject unauthorized references into arbitrary objects across the WordPress installation. This behavior effectively elevates the impact of low-privilege accounts, allowing them to perform actions reserved for administrators or editors depending on the configuration of custom fields and roles.
The operational impact of this vulnerability extends beyond simple data integrity issues. An attacker could exploit this flaw to disrupt site functionality by creating circular references or invalid relationships that may cause PHP errors or performance degradation during subsequent page loads. Furthermore, in environments where ACF is used for sensitive content management, such as membership sites or internal dashboards, an unauthorized contributor could potentially expose restricted information by linking their profile or a private post to publicly accessible entities they control. This undermines the confidentiality and integrity guarantees provided by WordPress's role-based access control system. The ability to add references arbitrarily also facilitates potential phishing attacks if social engineering is combined with this technical flaw, as attackers can manipulate how content appears linked within the admin interface.
This vulnerability aligns with MITRE ATT&CK technique T1078, Valid Accounts, specifically in the context of using legitimate but insufficiently privileged accounts to perform unauthorized actions due to application logic flaws rather than credential theft. It also relates to CWE-928, Improper Privilege Assignment, as the system incorrectly assigns write privileges based on a flawed assumption about user intent and capability during automated synchronization tasks. The lack of proper authorization checks allows for privilege escalation in effect, even if not in name, by enabling actions that should be restricted to higher-level roles.
Mitigation strategies must prioritize immediate software updates. Administrators running versions of Advanced Custom Fields prior to 6.8.11 are strongly advised to upgrade to the latest patched version where this authorization check has been implemented correctly. Until an update is applied, site administrators can mitigate risk by restricting user capabilities further through custom code or plugins that enforce stricter permissions on ACF field groups and relationship fields. Additionally, implementing Web Application Firewall rules that monitor for unusual patterns of post meta updates from low-privilege users may provide a layer of defense against exploitation attempts. Regular auditing of user roles and ensuring the principle of least privilege is strictly enforced across all custom content types can also reduce the attack surface available to potential adversaries exploiting this logic flaw.