CVE-2026-8382
Authorization Bypass in Advanced Custom Fields WordPress Plugin
Publication date: 2026-05-31
Last updated on: 2026-05-31
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| advanced_custom_fields | acf | to 6.8.1 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The Advanced Custom Fields (ACF®) plugin for WordPress has an authorization bypass vulnerability in all versions up to and including 6.8.1. This means the plugin does not properly verify if a user is authorized to perform certain actions.
As a result, unauthenticated attackers can overwrite the post_title and post_content of any post that is linked to a publicly accessible acf_form() instance by injecting values into the _post_title and _post_content parameters during a form submission.
How can this vulnerability impact me? :
This vulnerability allows attackers who are not logged in to modify the title and content of posts on a WordPress site using the ACF plugin.
Such unauthorized modifications can lead to content tampering, misinformation, defacement, or other integrity issues on the affected website.
The CVSS score of 5.3 indicates a medium severity impact focused on integrity, with no impact on confidentiality or availability.