PT-2026-45169 · WordPress · Advanced Custom Fields Pro

Sarawut Poolkhet · CVE-2026-8382 · Published 2026-05-31 · Updated 2026-05-31

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Advanced Custom Fields versions prior to 6.8.2

Description The Advanced Custom Fields plugin for WordPress contains an authorization bypass issue because it fails to properly verify if a user is authorized to perform specific actions. Unauthenticated attackers can overwrite the post title and post content of any post linked to a publicly accessible acf form() instance. This is achieved by injecting values into the post title and post content parameters during a form submission request.

Recommendations Update to version 6.8.2 or later. As a temporary mitigation, restrict public access to acf form() instances.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-8382

Affected Products

Advanced Custom Fields Pro

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-8382 · Security Note
• https://plugins.trac.wordpress.org/browser/advanced-custom-fields/tags/6.8.0/includes/forms/form-front.php#L243 · Note
• https://twitter.com/VulmonFeeds/status/2060950505229066339 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/ddb2290d-d4bd-4f70-9fe9-927f49721811?source=cve · Note
• https://t.me/cveNotify/165354 · Telegram Post
• https://t.me/CVEtracker/55371 · Telegram Post
• https://plugins.trac.wordpress.org/changeset/3549586/advanced-custom-fields/trunk/includes/forms/form-front.php · Note