Advanced Custom Fields (ACF®) vulnerabilities

Known security issues in the Advanced Custom Fields (ACF®) WordPress plugin, by affected version, with severity, CVE and the version that fixes each one.

Plugin slug: advanced-custom-fields
Latest version: 6.8.10
Active installs: 2,000,000+
Known vulnerabilities: 33
Data updated: 2026-10-18 07:31 UTC

View on wordpress.org

Check your version

This information comes from public vulnerability databases and may be incomplete or out of date. A plugin with no known vulnerabilities is not proof that it is secure; keep plugins updated and remove the ones you do not use.

Fixed in version 6.8.2 (2)

Advanced Custom Fields (ACF®): Fixed in version 6.8.2
Vulnerability	Severity	CVSS	Affected versions	Published
Advanced Custom Fields (ACF®) <= 6.8.1 - Unauthenticated Arbitrary Post Modification via Front-End Form '_post_title' and '_post_content' Parameters CVE-2026-8382 · Source	Medium	5.3	< 6.8.2	2026-05-30
Advanced Custom Fields (ACF®) <= 6.8.1 - Missing Authorization No CVE assigned · Source	Not rated	-	< 6.8.2	2026-05-27

Fixed in version 6.7.1 (1)

Advanced Custom Fields (ACF®): Fixed in version 6.7.1
Vulnerability	Severity	CVSS	Affected versions	Published
Advanced Custom Fields (ACF®) <= 6.7.0 - Unauthenticated Missing Authorization to Arbitrary Post/Page Disclosure via AJAX Field Query Parameters CVE-2026-4812 · Source	Not rated	-	< 6.7.1	0000-00-00

Fixed in version 6.4.3 (1)

Advanced Custom Fields (ACF®): Fixed in version 6.4.3
Vulnerability	Severity	CVSS	Affected versions	Published
Advanced Custom Fields <= 6.4.2. - HTML Injection CVE-2025-54940 · Source	Low	3.4	< 6.4.3	2025-08-08

Fixed in version 6.3.9 (2)

Advanced Custom Fields (ACF®): Fixed in version 6.3.9
Vulnerability	Severity	CVSS	Affected versions	Published
Advanced Custom Fields <= 6.3.8 & Secure Custom Fields <= 6.3.6.2 - Authenticated (Admin+) Stored Cross-Site Scripting CVE-2024-49593 · Source	Medium	5.3	< 6.3.9	2024-10-15
WordPress Advanced Custom Fields Plugin <= 6.3.6.2 is vulnerable to Cross Site Scripting (XSS) No CVE assigned · Source	Not rated	-	< 6.3.9	2024-10-16

Fixed in version 6.3.8 (1)

Advanced Custom Fields (ACF®): Fixed in version 6.3.8
Vulnerability	Severity	CVSS	Affected versions	Published
Advanced Custom Fields <= 6.3.8 - Authenticated (Admin+) Limited Arbitrary Function Call CVE-2024-9529 · Source	Medium	6.6	< 6.3.8	2024-10-07

Fixed in version 6.3.6 (1)

Advanced Custom Fields (ACF®): Fixed in version 6.3.6
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Plugin "Advanced Custom Fields" vulnerable to cross-site scripting CVE-2024-45429 · Source	Medium	6.1	< 6.3.6	2024-09-04

Fixed in version 6.3.0 (1)

Advanced Custom Fields (ACF®): Fixed in version 6.3.0
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Advanced Custom Fields Plugin < 6.3 is vulnerable to Sensitive Data Exposure CVE-2024-4565 · Source	Medium	6.5	< 6.3.0	2024-05-30

Fixed in version 6.2.5 (2)

Advanced Custom Fields (ACF®): Fixed in version 6.2.5
Vulnerability	Severity	CVSS	Affected versions	Published
Advanced Custom Fields <= 6.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Field CVE-2023-6701 · Source	Medium	5.4	< 6.2.5	2024-01-17
WordPress Advanced Custom Fields Plugin < 6.2.5 is vulnerable to Cross Site Scripting (XSS) No CVE assigned · Source	Not rated	-	< 6.2.5	2024-01-16

Fixed in version 6.1.8 (1)

Advanced Custom Fields (ACF®): Fixed in version 6.1.8
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Advanced Custom Fields Plugin <= 6.1.7 is vulnerable to Cross Site Scripting (XSS) No CVE assigned · Source	Not rated	-	< 6.1.8	2023-08-03

Fixed in version 6.1.6 (1)

Advanced Custom Fields (ACF®): Fixed in version 6.1.6
Vulnerability	Severity	CVSS	Affected versions	Published
Advanced Custom Fields (Free and Pro) 5.8.10 to 5.12.5 & 6.0.0 to 6.1.5 - Reflected Cross-Site Scripting via 'post_status' CVE-2023-30777 · Source	High	7.1	< 6.1.6	2023-05-04

Fixed in version 5.12.5 (2)

Advanced Custom Fields (ACF®): Fixed in version 5.12.5
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Advanced Custom Fields PRO Plugin < 6.1.0 is vulnerable to PHP Object Injection CVE-2023-1196 · Source	High	8.8	< 5.12.5	2023-04-03
WordPress Advanced Custom Fields Plugin <= 6.0.7 is vulnerable to PHP Object Injection No CVE assigned · Source	Not rated	-	< 5.12.5	2023-04-04

Fixed in version 5.12.3 (1)

Advanced Custom Fields (ACF®): Fixed in version 5.12.3
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Advanced Custom Fields plugin <= 5.12.2 - Unauthenticated File Upload vulnerability CVE-2022-2594 · Source	High	8.8	< 5.12.3	2022-07-14

Fixed in version 5.12.1 (2)

Advanced Custom Fields (ACF®): Fixed in version 5.12.1
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Plugin "Advanced Custom Fields" vulnerable to missing authorization CVE-2022-23183 · Source	Medium	6.5	< 5.12.1	2022-03-30
Multiple missing authorization vulnerabilities in WordPress Plugin "Advanced Custom Fields" CVE-2021-20867 · Source	Medium	6.5	< 5.12.1	2021-12-02

Fixed in version 5.11 (2)

Advanced Custom Fields (ACF®): Fixed in version 5.11
Vulnerability	Severity	CVSS	Affected versions	Published
Multiple missing authorization vulnerabilities in WordPress Plugin "Advanced Custom Fields" CVE-2021-20865 · Source	High	7.5	< 5.11	2021-12-02
Multiple missing authorization vulnerabilities in WordPress Plugin "Advanced Custom Fields" CVE-2021-20866 · Source	Medium	6.5	< 5.11	2021-12-02

Fixed in version 5.10 (1)

Advanced Custom Fields (ACF®): Fixed in version 5.10
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Advanced Custom Fields plugin <= 5.9.9 - Arbitrary ACF Data/Field Groups View and Fields Move vulnerability No CVE assigned · Source	Not rated	-	< 5.10	2021-08-25

Fixed in version 5.8.12 (1)

Advanced Custom Fields (ACF®): Fixed in version 5.8.12
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Advanced Custom Fields plugin <= 5.8.11 - Cross-Site Scripting (XSS) vulnerability CVE-2020-36172 · Source	Medium	6.1	< 5.8.12	2020-06-10

Fixed in version 5.7.12 (2)

Advanced Custom Fields (ACF®): Fixed in version 5.7.12
Vulnerability	Severity	CVSS	Affected versions	Published
Advanced Custom Fields <= 5.7.11 - PHP Object Injection No CVE assigned · Source	Not rated	-	< 5.7.12	2019-02-15
Advanced Custom Fields <= 5.7.10 - Unserialize of user input No CVE assigned · Source	Not rated	-	< 5.7.12	-

Fixed in version 5.7.8 (2)

Advanced Custom Fields (ACF®): Fixed in version 5.7.8
Vulnerability	Severity	CVSS	Affected versions	Published
Advanced Custom Fields <= 5.7.7 - Authenticated Cross-Site Scripting (XSS) CVE-2018-20986 · Source	Medium	5.4	< 5.7.8	2018-12-07
WordPress Advanced Custom Fields plugin <= 5.7.7 - Authenticated Cross-Site Scripting (XSS) vulnerability No CVE assigned · Source	Not rated	-	< 5.7.8	2018-12-10

Fixed in version 3.5.2 (4)

Advanced Custom Fields (ACF®): Fixed in version 3.5.2
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Advanced Custom Fields Plugin <= 3.5.1 is vulnerable to Remote Code Execution (RCE) No CVE assigned · Source	Not rated	-	< 3.5.2	2025-08-05
WordPress Advanced Custom Fields Plugin - Remote File Inclusion No CVE assigned · Source	Not rated	-	< 3.5.2	2013-01-03
Advanced Custom Fields <= 3.5.1 - Remote Code Execution via Remote File Inclusion CVE-2012-10025 · Source	Not rated	-	< 3.5.2	2013-01-03
Advanced Custom Fields <= 3.5.1 - Remote File Inclusion No CVE assigned · Source	Not rated	-	< 3.5.2	-

Fixed in version 1.1.13 (1)

Advanced Custom Fields (ACF®): Fixed in version 1.1.13
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Advanced Custom Fields Plugin <= 1.1.12 - Stored Cross Site Scripting No CVE assigned · Source	Not rated	-	< 1.1.13	2016-08-08

Affects version 6.1.7 and earlier (1)

The source does not state the fixed version; versions after this one are not listed as affected.

Advanced Custom Fields (ACF®): Affects version 6.1.7 and earlier
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Plugin "Advanced Custom Fields" vulnerable to cross-site scripting CVE-2023-40068 · Source	Medium	5.4	>= 6.1.0 and <= 6.1.7	2023-08-03

Affects version 6.0.2 and earlier (1)

The source does not state the fixed version; versions after this one are not listed as affected.

Advanced Custom Fields (ACF®): Affects version 6.0.2 and earlier
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Advanced Custom Fields plugin 3.1.1 - 6.0.2 - Custom Field Value Exposure vulnerability CVE-2022-40696 · Source	Low	3.7	>= 3.1.1 and <= 6.0.2	2022-10-18

Check every plugin on your site automatically

Install the free Webforta Security plugin for WordPress and Webforta matches every plugin, theme and WordPress version you run against known vulnerabilities, and tells you when a new one affects your site.

Start free About the WordPress plugin

Sources and attribution

Vulnerability data from WPVulnerability (WordPress, plugins, themes and server software). WPVulnerability data license.
CVE records are copyright The MITRE Corporation. CVE Terms of Use.
Known-exploited status from the CISA Known Exploited Vulnerabilities catalog. Public domain (U.S. Government work).
Plugin names, latest versions and install counts from the WordPress.org plugin directory. WordPress is a trademark of the WordPress Foundation; Webforta is not affiliated with or endorsed by WordPress.org, WPVulnerability or the sources above.