CVE-2026-8382: Advanced Custom Fields Authorization Bypass (ACF WordPress Plugin)

Technical summary

CVE-2026-8382 is an authorization bypass vulnerability in ACF (CWE-862: Missing Authorization) affecting versions through 6.8.1. The plugin fails to validate user permissions before processing form submissions tied to acf_form() instances. Specifically, unauthenticated attackers can craft POST requests containing _post_title and _post_content parameters to overwrite post metadata on publicly accessible forms. The vulnerability requires no authentication, no user interaction, and has a network attack vector, resulting in a CVSS 3.1 score of 5.3 (Medium severity).

Business impact

Website defacement and content tampering pose immediate reputational risks, particularly for organizations publishing time-sensitive or regulated content. Attackers could inject malicious links, promotional content, or misleading information into live posts. While the vulnerability does not expose data or cause availability loss, the integrity compromise can erode user trust and trigger incident response overhead. Websites relying on ACF forms for managed content pipelines face operational disruption if remediation requires form reconfiguration.

Affected systems

Any WordPress installation running the Advanced Custom Fields plugin version 6.8.1 or earlier is vulnerable if it has one or more publicly accessible acf_form() instances. The risk is heightened for sites using ACF forms for guest submissions, user-generated content collection, or public-facing workflows. Private or restricted forms behind authentication are not directly exploitable via this vector.

Exploitability

Exploitation is straightforward: an attacker simply submits HTTP POST requests to a public form URL with crafted _post_title and _post_content parameters. No special tools, credentials, or user interaction are required. The low complexity and network accessibility make opportunistic attacks feasible, though the vulnerability was not added to CISA's Known Exploited Vulnerabilities (KEV) catalog as of the advisory publication date.

Remediation

Immediately update the ACF plugin to a patched version released after 6.8.1. Verify the specific patched version against the official ACF plugin repository or vendor advisory. As an interim measure, restrict access to acf_form() instances using WordPress capabilities checks, require user authentication for all form submissions, or disable public forms until patching is complete. Review published posts for unauthorized modifications in the past 30–90 days.

Patch guidance

Check the official Advanced Custom Fields plugin changelog and WordPress plugin directory for versions released after June 2026 containing security fixes for this authorization bypass. Apply the patch through WordPress's automated plugin update mechanism or manual upload. After patching, clear any plugin caches and test form functionality on a staging environment before production deployment. Consider staggered rollout if the plugin is critical to your content workflow.

Detection guidance

Monitor Web Application Firewall (WAF) logs for suspicious POST requests to acf_form() endpoints containing _post_title or _post_content parameters from non-authenticated sources. Review WordPress post revision histories and audit logs for unexpected changes to post_title or post_content fields on forms known to be public-facing. Check for patterns of mass modifications occurring within short timeframes. Implement logging of all ACF form submissions with source IP and parameter contents.

Why prioritize this

Although scored MEDIUM (5.3) and not yet in active exploitation, this vulnerability should be prioritized because it affects content integrity on public-facing websites and requires no attacker credentials. Organizations with publicly accessible ACF forms should patch within 48–72 hours. Lower-risk deployments (forms behind authentication, staging environments, low-visibility sites) can follow standard patch cycles but should not be deferred indefinitely.

Risk score, explained

CVSS 3.1 score 5.3 reflects a network-accessible vulnerability with no authentication requirement, low attack complexity, and direct impact on content integrity (the 'I:L' in the vector). The score excludes data confidentiality and availability impact, which are not affected. The 'PR:N/UI:N' indicates no prerequisite permissions or user interaction—a core reason for the integrity concern despite the 'MEDIUM' label.

Frequently asked questions