Advanced Custom Fields (ACF) structures the content of more than 2 million WordPress sites, and the CVE registry attributes 18 vulnerabilities to it published between January 2020 and early July 2026. None is critical, but a 2023 XSS was attacked the day after its publication, and in October 2024 the plugin went through a unique episode: its takeover by WordPress.org in the name of security. Here is the timeline, the vulnerabilities that matter and the right settings.
Advanced Custom Fields in brief
ACF adds custom fields (text, image, relationship, repeater...) to content, users or options pages. Published on wordpress.org since March 2011, the plugin belonged to Delicious Brains before being acquired by WP Engine, along with four other plugins, in June 2022. It comes in a free version and a paid version, ACF Pro. The official directory shows more than 2 million active installations (wordpress.org).
Agencies and freelancers use it as the foundation of custom sites, with themes built around get_field() and the_field(). ACF therefore handles data entered by every role, and sometimes by anonymous visitors through its front-end forms (acf_form()). And it is hard to remove: the theme depends on it.
Timeline of vulnerabilities since 2020
We counted the ACF vulnerabilities (free and Pro) that received a CVE identifier, based on the records in the cve.org registry, for advisories published from January 1, 2020 to July 4, 2026: 18 vulnerabilities, all fixed. Added to these is one vulnerability published by WPScan in May 2026 without a CVE. WPScan and Patchstack each miss a few vulnerabilities, notably those reported through the Japanese JPCERT.
| Published | Fixed in | Type | CVSS | CVE | Account required |
|---|---|---|---|---|---|
| June 10, 2020 (fix) | 5.8.12 | XSS in select fields | 6.1 (NVD) | CVE-2020-36172 | None (victim click) |
| December 2, 2021 | 5.11 | Three missing access controls | 6.5 to 7.5 (NVD) | CVE-2021-20865, CVE-2021-20866, CVE-2021-20867 | None to subscriber depending on the vulnerability |
| March 30, 2022 | 5.12.1 | Unauthorized data access | 6.5 (NVD) | CVE-2022-23183 | Contributor |
| July 25, 2022 | 5.12.3 (affected: 5.0 to 5.12.2) | File upload via a front-end form | 8.8 (NVD) | CVE-2022-2594 | None |
| October 18, 2022 | 6.0.3 (affected: 3.1.1 to 6.0.2) | Field value exposure | 3.7 (Patchstack), 7.5 (NVD) | CVE-2022-40696 | None according to Patchstack |
| April 10, 2023 | 5.12.5 and 6.1.0 (affected: 5.x before 5.12.5, 6.x before 6.1.0) | PHP object injection | 8.8 (NVD) | CVE-2023-1196 | Contributor |
| May 5, 2023 | 6.1.6 and 5.12.6 | Reflected XSS (documented attack attempts) | 7.1 (Patchstack), 6.1 (NVD) | CVE-2023-30777 | None (a logged-in user must click) |
| January 17, 2024 | 6.2.5 | Stored XSS via the shortcode | 6.4 (Wordfence), 5.4 (NVD) | CVE-2023-6701 | Contributor |
| May 30, 2024 | 6.3.0 | Reading fields via the shortcode | 6.5 (NVD) | CVE-2024-4565 | Contributor |
| October 9, 2024 | 6.3.8, hardened in 6.3.9 | Limited function call | 5.4 (Patchstack), 6.6 (CISA) | CVE-2024-9529 | Administrator |
| October 15, 2024 | 6.3.9 (affected: before 6.3.9, and Secure Custom Fields before 6.3.6.3) | Stored XSS in the field group editor | 5.3 (CISA) | CVE-2024-49593 | Administrator |
| April 14, 2026 | 6.7.1 | Reading private content via AJAX | 5.3 (Wordfence) | CVE-2026-4812 | None (front-end form) |
| May 27, 2026 | 6.8.2 | Changing fields via a front-end form | 5.3 (WPScan) | None | None |
| May 30, 2026 | 6.8.2 | Changing post titles and content | 5.3 (Wordfence) | CVE-2026-8382 | None (front-end form) |
Dates are those of the first public advisory (for 2020, that of the fix). The score is the one from the organization that assigned the CVE, otherwise from NVD or CISA. Most vulnerabilities also affected ACF Pro, fixed in the same versions. Four vulnerabilities not in the table required an administrator account or access to the ACF settings: stored XSS or HTML injections in labels, fixed in 6.1.8 (2023), 6.3.6 and 6.3.9 (2024) and 6.4.3 (2025).
The notable vulnerabilities explained
July 2022: files uploaded without an account (CVE-2022-2594)
James Golovich (Pritect) discovered that, since the version 5.0 rewrite, the "basic" file upload fields in ACF front-end forms were not protected by a security token (nonce). On a site exposing such a form, an anonymous visitor could drop files: not PHP, which WordPress blocks, but any allowed type, usable according to the researcher for a later attack or phishing. Vendor contacted on July 11, 2022, version 5.12.3 released on the 14th, public advisory on the 25th: an exemplary timeline. NVD rates the vulnerability 8.8.
April 2023: PHP object injection by a contributor (CVE-2023-1196)
ACF unserialized some user-controllable data. A Contributor account could thus inject a PHP object, which only becomes dangerous when a "gadget chain" is provided by another plugin or the theme. Reported by Nguyen Huu Do through WPScan, the vulnerability is rated 8.8 by NVD. Versions 6.1.0 and 5.12.5, released on April 3 and 4, 2023, now forbid unserializing classes. The mechanism is detailed in our article on PHP object injection.
May 2023: the reflected XSS attacked in under 48 hours (CVE-2023-30777)
Rafie Muhammad of Patchstack found that the post_status parameter of the field groups screen was added to the admin page's CSS classes after a mere sanitize_text_field, which is insufficient because WordPress outputs these classes without escaping them. An attacker without an account could craft a link that, when opened by a logged-in administrator, ran JavaScript in their browser. Patchstack rates the vulnerability 7.1, NVD 6.1. This type of attack is explained in our article on XSS vulnerabilities in WordPress.
Reported on May 2, 2023, the vulnerability was fixed on May 4 in 6.1.6, with a fix backported to 5.12.6, and Patchstack published its analysis with a sample request on May 5. From May 6, Akamai observed significant scanning and attack attempt activity reusing Patchstack's example word for word, on sites in every sector. Akamai does not say whether any sites were compromised, and Patchstack stated on May 16 that it had not seen concrete attempts among its customers.
2024: the ACF shortcode and output escaping
The [acf] shortcode was the weak spot from 2022 to 2024. In January 2024, Francesco Carlucci and Wordfence showed that a contributor without the unfiltered_html capability could save malicious HTML in a metadata field and display it through this shortcode (CVE-2023-6701, reported on December 12, 2023, fixed in 6.2.5 on January 16, 2024). In May, CVE-2024-4565 showed that the same shortcode displayed the fields of any post without checking permissions. The vendor went beyond the fix: shortcode disabled by default on new installations since 6.3.0, and removal of unsafe HTML by the_field() announced for 6.2.7.
2026: front-end forms in the crosshairs
The three 2026 vulnerabilities have one thing in common: they target ACF front-end forms and require no account. CVE-2026-4812, reported by Fernando Mecozzi and published by Wordfence on April 14, made it possible to obtain information about drafts and private content through the AJAX requests of Relationship or Post Object fields, bypassing the configured restrictions. The fix, in 6.7.1, had been out since March 3. At the end of May, Sarawut Poolkhet published two vulnerabilities fixed in 6.8.2 (May 26): one allowed changing any field of the post linked to the form, even a field that was not displayed, the other overwriting its title and content (CVE-2026-8382). All are rated 5.3, but they affect the confidentiality or integrity of content without authentication.
October 2024: ACF taken over by WordPress.org
This episode mixes security and a legal dispute. On September 25, 2024, Matt Mullenweg announced on WordPress.org that WP Engine, in litigation with him, no longer had free access to the site's resources. The ACF team could no longer publish to the directory and set up its own update channel.
On October 7, ACF released version 6.3.8, which fixed a vulnerability reported by Automattic's security team (CVE-2024-9529): an administrator could have PHP functions executed through the callback functions of post types and taxonomies created with ACF, notably via settings import. The vendor describes it as an "unlikely" scenario between two administrators; Patchstack classifies it as low priority, "unlikely to be exploited". ACF says it sent a copy of the fix to the WordPress.org security team, which released it as 6.3.6.1.
On October 12, WordPress.org announced, on behalf of its security team, that it was invoking point 18 of the directory guidelines to create a fork of ACF named Secure Custom Fields (SCF), in order, it said, to fix a security issue and remove commercial upsells. Sites receiving automatic updates from WordPress.org were switched to SCF. The text speaks of a "rare and unusual" situation caused by WP Engine's legal actions. The ACF team replied the same day that a plugin under active development had never been taken from its creator without consent, called this code "unauthorized" and invited its users to download 6.3.8 from its website.
Three days later, the same administrator-only stored XSS was fixed in both branches (CVE-2024-49593, ACF 6.3.9 and SCF 6.3.6.3): a fork also inherits the vulnerabilities of the original code. On December 10, 2024, a federal court in California issued a preliminary order to restore WP Engine's access to WordPress.org and its control of the ACF listing; Automattic sees it as a measure meant to preserve the status quo and is pursuing the case. In mid-December, the listing went back to WP Engine, while SCF continues under its own name, published by WordPress.org.
For a site owner, the lesson is not to pick a side, but to know where your updates come from: in October 2024, an automatic update could replace one plugin with another. Check whether you use ACF or SCF, and that this channel actually delivers the fixes to you. This distribution channel risk is covered in our article on supply chain attacks.
What this history shows
- No critical vulnerability, but unauthenticated ones: eight of the nineteen vulnerabilities require no account from the attacker, whether through a booby-trapped link or, four times, through a front-end form.
- Access control keeps coming back: reading data, fields or private content in 2021, 2022, 2024 and 2026. Each new way of displaying fields (shortcode, AJAX, form) had to be locked down after the fact.
- Intermediate roles matter: four vulnerabilities only require a Contributor account. Keep these accounts to the strict minimum (see our article on roles and least privilege).
- Fixes are fast: three days for the file upload in 2022, two days for the 2023 XSS. In April 2026, the fix preceded the advisory by six weeks.
To place ACF in the broader landscape, see our timeline of WordPress core vulnerabilities and our analysis of plugin vulnerabilities by the numbers.
Protecting your site
- Update: any version 6.8.2 or later fixes all the vulnerabilities in the table.
- Turn on automatic updates for ACF (automatic plugin updates).
- Audit your front-end forms: if you use
acf_form(), limit the exposed fields with thefieldsoption and remove those no longer needed. Leave the shortcode disabled if your theme does not use it. - Remove unnecessary plugins, including an ACF or SCF that is no longer used (abandoned plugins).
- Add a web application firewall capable of virtual patching to cover the hours after an advisory (WAF comparison), and monitor the vulnerabilities of your plugins (monitoring plugin vulnerabilities).
WP Masquerade Pro can help with this last point. Every day, it compares the versions of your installed plugins and themes with the public WPVulnerability.net database and sends you a vulnerability alert by email with the severity and the fixed version. The member area lists pending updates and vulnerable sites (monitoring your sites). WP Masquerade alerts, it does not fix plugins and it is not a firewall: updating remains your decisive step. To round out your toolkit, see our selection of the best WordPress security plugins.
Key takeaways
- 18 ACF vulnerabilities with a CVE from January 1, 2020 to July 4, 2026, none critical, all fixed.
- The CVE-2023-30777 XSS was the target of attack attempts less than 48 hours after the fix.
- Recommended minimum version: 6.8.2; install the latest.
- Front-end forms (
acf_form()) and the shortcode are the sensitive points: limit them. - Since October 2024, check whether you use ACF or Secure Custom Fields, and where your updates come from.
Sources
- WordPress.org: Advanced Custom Fields (ACF®) plugin (external link, opens in a new tab)
- NVD: CVE-2022-2594 (August 22, 2022) (external link, opens in a new tab)
- CVE.org: CVE-2023-30777 (May 10, 2023) (external link, opens in a new tab)
- WordPress.org: WP Engine is banned from WordPress.org (September 25, 2024) (external link, opens in a new tab)
Other sources consulted: further CVE records, official vendor pages, security research publications, trade press articles, WPScan and Patchstack databases.
