CVE-2026-8382
Deferred Deferred - Pending Action
Authorization Bypass in Advanced Custom Fields WordPress Plugin

Publication date: 2026-05-31

Last updated on: 2026-05-31

Assigner: Wordfence

Description
The Advanced Custom Fields (ACF®) plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.8.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to overwrite the post_title and post_content of any post bound to a publicly accessible acf_form() instance by injecting values into the _post_title and _post_content parameters of a form submission request.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-05-31
Last Modified
2026-05-31
Generated
2026-06-20
AI Q&A
2026-05-31
EPSS Evaluated
2026-06-19
NVD
CVE-2026-8382
EUVD
EUVD-2026-33483
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
advanced_custom_fields acf to 6.8.1 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

The Advanced Custom Fields (ACF®) plugin for WordPress has an authorization bypass vulnerability in all versions up to and including 6.8.1. This means the plugin does not properly verify if a user is authorized to perform certain actions.

As a result, unauthenticated attackers can overwrite the post_title and post_content of any post that is linked to a publicly accessible acf_form() instance by injecting values into the _post_title and _post_content parameters during a form submission.

Impact Analysis

This vulnerability allows attackers who are not logged in to modify the title and content of posts on a WordPress site using the ACF plugin.

Such unauthorized modifications can lead to content tampering, misinformation, defacement, or other integrity issues on the affected website.

The CVSS score of 5.3 indicates a medium severity impact focused on integrity, with no impact on confidentiality or availability.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-8382. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart