Security Alert Summary
The Advanced Custom Fields (ACF) WordPress plugin contains a vulnerability that allows authenticated users with contributor-level access and above to add or remove a reference to their own object on arbitrary posts, users, or terms they cannot otherwise edit. This occurs during bidirectional relationship synchronization when the plugin does not verify that the acting user is allowed to edit the target object.
CVE Details
- CVE ID:
CVE-2026-97190 - Affected component: Advanced Custom Fields (ACF)
- Affected versions: version 6.2.0 and versions less than 6.8.11 (described as before 6.8.11)
- Published: November 7, 2026 at 6:16:59 AM UTC
- Last modified: November 7, 2026 at 6:16:59 AM UTC
- CVSS v3.1: Not provided in the CVE data
- Authentication / privileges required: An authenticated user with contributor-level access or higher can exploit the issue (as described)
- User interaction: Requires an authenticated user action consistent with creating or updating relationships; no additional user interaction data provided
- Primary impact: Integrity – unauthorized modification of object relationship references; Confidentiality – limited/indirect (depends on site data); Availability – none indicated
- CWE / weakness ID: Not provided in the CVE data
Technical Details
The vulnerability exists because the plugin does not verify that the current user is permitted to edit the target object when performing bidirectional relationship synchronization. During synchronization, the code writes a reference to the target object without confirming the acting user’s edit permissions for that target. As a result, authenticated users with contributor-level access or higher can add or remove a reference to their own object on arbitrary posts, users, or terms they would not normally be able to edit.
No specific functions, REST API endpoints, or code paths were named in the provided CVE data. The root cause described is a missing permission check during the bidirectional relationship write operation.
Impact is limited to modification of relationship data: attackers with the described privileges can alter which posts, users, or terms reference their object, potentially affecting content integrity, display logic, or user association data. The CVE description does not state that full site takeover or direct disclosure of sensitive data is possible solely via this issue.
How This Could Impact Your Website
Consider a multisite workflow with a site owner, internal staff editors, and external contributors. A contributor could use this issue to associate their own user object or content item with posts, users, or terms they cannot otherwise edit. Practically, this could:
- Alter relationships that control where content appears or which users are attributed to content, causing misinformation in listings or author displays.
- Expose or surface internal user references in contexts where those relationships are used for display or filtering, which could increase the risk of targeted phishing or social engineering.
- Undermine data integrity for taxonomies, user associations, or custom content types that rely on relationship fields.
If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles and capabilities, especially for contributors and other non-editor accounts.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site.
- Monitor site activity and logs for unusual behavior related to post, user, or term relationship changes.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
