CVE-2026-97191 in Advanced Custom Fields Plugin
Summary
by MITRE • 11/07/2026
The Advanced Custom Fields (ACF®) WordPress plugin before 6.8.11 does not re-apply its field-group location rules when persisting values submitted through the post editor save path, allowing users with contributor-level access and above to write custom fields the site restricted to administrators onto their own posts.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 11/07/2026
The vulnerability identified in Advanced Custom Fields (ACF) versions prior to 6.8.11 represents a critical authorization bypass within WordPress plugin architecture that allows privilege escalation through improper validation of field-group location rules during data persistence operations. This flaw specifically targets the post editor save path, where user-submitted values are processed and stored in the database without re-evaluating the security constraints defined by the site administrator. In standard WordPress environments, ACF is designed to enforce strict access controls based on role-based permissions and field-group location rules, which dictate who can edit specific custom fields. However, due to a logic error in the save handler, these restrictions are not reapplied when data is committed via the post editor interface, effectively creating an authorization gap that undermines the intended security model of the application.
From a technical perspective, this issue stems from how the plugin handles input validation and access control checks during the write operation rather than just the read or display phase. When a user with contributor-level access or higher submits data through the post editor, the system accepts the payload without verifying whether the current user is authorized to modify the specific custom fields being updated according to their assigned location rules. This oversight allows lower-privileged users to bypass administrative restrictions and write arbitrary values into fields that were explicitly configured for administrator-only use. The absence of a secondary authorization check during the persistence phase means that the security boundary defined by field-group configurations is effectively nullified, enabling unauthorized data manipulation at the database level.
The operational impact of this vulnerability is significant, particularly in multi-author WordPress sites where role differentiation is critical for content governance and data integrity. Attackers with contributor or author privileges can exploit this flaw to inject malicious payloads into custom fields that are typically reserved for administrative configuration or sensitive metadata storage. This could lead to cross-site scripting attacks if the stored values are rendered without proper sanitization, privilege escalation by modifying user meta-data or site settings exposed through these fields, and general data integrity compromise where critical information is altered by unauthorized parties. Furthermore, this vulnerability undermines trust in role-based access control mechanisms, potentially exposing sensitive business logic or internal configurations that were intended to remain hidden from lower-tier users.
To mitigate this risk, organizations running affected versions of Advanced Custom Fields must immediately upgrade to version 6.8.11 or later, where the developers have implemented proper re-validation of field-group location rules during the save process. Until an update is applied, administrators should consider restricting post editor access for lower-privileged roles if feasible, although this may impact workflow efficiency. Additionally, implementing Web Application Firewall rules that monitor for anomalous patterns in custom field submissions can provide a layer of defense-in-depth by detecting and blocking requests that attempt to write to restricted fields. Regular security audits focusing on role-based permissions within WordPress plugins are also recommended to identify similar logic flaws before they can be exploited.
This vulnerability aligns with CWE-269, which describes Improper Privilege Management, as it involves a failure to enforce proper access controls for elevated functions or data. It is further categorized under ATT&CK technique T1078, Valid Accounts, specifically relating to the misuse of legitimate user credentials and roles to bypass security restrictions. The exploitation vector falls within the broader category of authorization flaws where an actor exploits insufficient checks during state-changing operations rather than initial authentication. Understanding this context helps in applying targeted patches and configuring monitoring tools to detect similar privilege escalation attempts across other WordPress plugins that may share analogous architectural patterns.