{ "title": "ACF security vulnerabilities: timeline, exploits and patches", "seo_title": "Advanced Custom Fields (ACF) flaws: CVEs and fixes", "h1": "ACF security vulnerabilities: timeline, exploits and patches", "description": "Advanced Custom Fields: 18 vulnerabilities with a CVE since 2020, the XSS attacked in 2023, the 2024 Secure Custom Fields fork and how to protect sites.", "lead": "18 vulnerabilities with a CVE since 2020, none critical, but an XSS attacked in under 48 hours and a takeover by WordPress.org in 2024: ACF's security history, explained.", "language": "en", "locale": "en-US", "type": "article", "url": "https://www.wp-masquerade.com/advanced-custom-fields-security-vulnerabilities/", "canonical": "https://www.wp-masquerade.com/advanced-custom-fields-security-vulnerabilities/", "markdown": "https://www.wp-masquerade.com/advanced-custom-fields-security-vulnerabilities/index.md", "json": "https://www.wp-masquerade.com/advanced-custom-fields-security-vulnerabilities/index.json", "published": "2026-07-07T07:00:00+00:00", "modified": "2026-10-29T07:36:32+00:00", "site": { "name": "WP Masquerade", "url": "https://www.wp-masquerade.com/" }, "translations": [ { "language": "en", "hreflang": "en-US", "title": "ACF security vulnerabilities: timeline, exploits and patches", "url": "https://www.wp-masquerade.com/advanced-custom-fields-security-vulnerabilities/", "markdown": "https://www.wp-masquerade.com/advanced-custom-fields-security-vulnerabilities/index.md", "json": "https://www.wp-masquerade.com/advanced-custom-fields-security-vulnerabilities/index.json" }, { "language": "fr", "hreflang": "fr-FR", "title": "Failles de sécurité ACF : chronologie, exploits et correctifs", "url": "https://www.wp-masquerade.com/fr/failles-securite-advanced-custom-fields/", "markdown": "https://www.wp-masquerade.com/fr/failles-securite-advanced-custom-fields/index.md", "json": "https://www.wp-masquerade.com/fr/failles-securite-advanced-custom-fields/index.json" }, { "language": "es", "hreflang": "es-ES", "title": "Vulnerabilidades de ACF: cronología, exploits y parches", "url": "https://www.wp-masquerade.com/es/vulnerabilidades-advanced-custom-fields/", "markdown": "https://www.wp-masquerade.com/es/vulnerabilidades-advanced-custom-fields/index.md", "json": "https://www.wp-masquerade.com/es/vulnerabilidades-advanced-custom-fields/index.json" }, { "language": "de", "hreflang": "de-DE", "title": "ACF-Sicherheitslücken: Chronologie, Exploits und Patches", "url": "https://www.wp-masquerade.com/de/advanced-custom-fields-sicherheitsluecken/", "markdown": "https://www.wp-masquerade.com/de/advanced-custom-fields-sicherheitsluecken/index.md", "json": "https://www.wp-masquerade.com/de/advanced-custom-fields-sicherheitsluecken/index.json" }, { "language": "it", "hreflang": "it-IT", "title": "Vulnerabilità di ACF: cronologia, exploit e patch", "url": "https://www.wp-masquerade.com/it/vulnerabilita-sicurezza-advanced-custom-fields/", "markdown": "https://www.wp-masquerade.com/it/vulnerabilita-sicurezza-advanced-custom-fields/index.md", "json": "https://www.wp-masquerade.com/it/vulnerabilita-sicurezza-advanced-custom-fields/index.json" }, { "language": "pt", "hreflang": "pt-BR", "title": "Vulnerabilidades do ACF: cronologia, exploits e correções", "url": "https://www.wp-masquerade.com/pt/vulnerabilidades-seguranca-advanced-custom-fields/", "markdown": "https://www.wp-masquerade.com/pt/vulnerabilidades-seguranca-advanced-custom-fields/index.md", "json": "https://www.wp-masquerade.com/pt/vulnerabilidades-seguranca-advanced-custom-fields/index.json" }, { "language": "nl", "hreflang": "nl-NL", "title": "ACF-beveiligingslekken: tijdlijn, exploits en patches", "url": "https://www.wp-masquerade.com/nl/advanced-custom-fields-kwetsbaarheden-beveiliging/", "markdown": "https://www.wp-masquerade.com/nl/advanced-custom-fields-kwetsbaarheden-beveiliging/index.md", "json": "https://www.wp-masquerade.com/nl/advanced-custom-fields-kwetsbaarheden-beveiliging/index.json" } ], "headings": [ { "level": 1, "text": "ACF security vulnerabilities: timeline, exploits and patches" }, { "level": 2, "text": "Advanced Custom Fields in brief" }, { "level": 2, "text": "Timeline of vulnerabilities since 2020" }, { "level": 2, "text": "The notable vulnerabilities explained" }, { "level": 3, "text": "July 2022: files uploaded without an account (CVE-2022-2594)" }, { "level": 3, "text": "April 2023: PHP object injection by a contributor (CVE-2023-1196)" }, { "level": 3, "text": "May 2023: the reflected XSS attacked in under 48 hours (CVE-2023-30777)" }, { "level": 3, "text": "2024: the ACF shortcode and output escaping" }, { "level": 3, "text": "2026: front-end forms in the crosshairs" }, { "level": 2, "text": "October 2024: ACF taken over by WordPress.org" }, { "level": 2, "text": "What this history shows" }, { "level": 2, "text": "Protecting your site" }, { "level": 3, "text": "Key takeaways" }, { "level": 2, "text": "Sources" }, { "level": 2, "text": "WordPress security, without the noise", "id": "wpm-nl-box-title" } ], "body": "Advanced Custom Fields (ACF) structures the content of more than 2 million WordPress sites, and the [CVE](https://www.wp-masquerade.com/glossary/cve/) registry attributes 18 vulnerabilities to it published between January 2020 and early July 2026. None is critical, but a 2023 [XSS](https://www.wp-masquerade.com/glossary/xss/) was attacked the day after its publication, and in October 2024 the plugin went through a unique episode: its takeover by WordPress.org in the name of security. Here is the timeline, the vulnerabilities that matter and the right settings.\n\n## Advanced Custom Fields in brief\n\nACF adds custom fields (text, image, relationship, repeater...) to content, users or options pages. Published on wordpress.org since March 2011, the plugin belonged to Delicious Brains before being acquired by **WP Engine**, along with four other plugins, in June 2022. It comes in a free version and a paid version, ACF Pro. The official directory shows **more than 2 million active installations (wordpress.org)**.\n\nAgencies and freelancers use it as the foundation of custom sites, with themes built around `get_field()` and `the_field()`. ACF therefore handles data entered by every role, and sometimes by anonymous visitors through its front-end forms (`acf_form()`). And it is hard to remove: the theme depends on it.\n\n## Timeline of vulnerabilities since 2020\n\nWe counted the ACF vulnerabilities (free and Pro) that received a CVE identifier, based on the records in the **cve.org** registry, for advisories published from January 1, 2020 to July 4, 2026: **18 vulnerabilities**, all fixed. Added to these is one vulnerability published by WPScan in May 2026 without a CVE. WPScan and Patchstack each miss a few vulnerabilities, notably those reported through the Japanese JPCERT.\n\n![Timeline of Advanced Custom Fields: XSS fixed in 5.8.12 on June 10, 2020, three missing access controls on December 2, 2021, unauthenticated file upload on July 25, 2022, PHP object injection on April 10, 2023, reflected XSS CVE-2023-30777 on May 5, 2023 with attack attempts observed by Akamai, contributor XSS on January 17, 2024, vulnerability reported by Automattic on October 7, 2024, fork into Secure Custom Fields on October 12, 2024, plugin listing returned to WP Engine in December 2024, private content readable on April 14, 2026 and unauthenticated post modification on May 30, 2026](https://www.wp-masquerade.com/media/2026/10/chronologie-failles-advanced-custom-fields-en.webp)\n\n*Eleven key dates: mostly medium vulnerabilities, an XSS attacked in 2023 and the October 2024 crisis.*\n\n| Published | Fixed in | Type | CVSS | CVE | Account required |\n| --- | --- | --- | --- | --- | --- |\n| June 10, 2020 (fix) | 5.8.12 | XSS in select fields | 6.1 (NVD) | CVE-2020-36172 | None (victim click) |\n| December 2, 2021 | 5.11 | Three missing access controls | 6.5 to 7.5 (NVD) | CVE-2021-20865, CVE-2021-20866, CVE-2021-20867 | None to subscriber depending on the vulnerability |\n| March 30, 2022 | 5.12.1 | Unauthorized data access | 6.5 (NVD) | CVE-2022-23183 | Contributor |\n| July 25, 2022 | 5.12.3 (affected: 5.0 to 5.12.2) | File upload via a front-end form | 8.8 (NVD) | CVE-2022-2594 | None |\n| October 18, 2022 | 6.0.3 (affected: 3.1.1 to 6.0.2) | Field value exposure | 3.7 (Patchstack), 7.5 (NVD) | CVE-2022-40696 | None according to Patchstack |\n| April 10, 2023 | 5.12.5 and 6.1.0 (affected: 5.x before 5.12.5, 6.x before 6.1.0) | PHP object injection | 8.8 (NVD) | CVE-2023-1196 | Contributor |\n| May 5, 2023 | 6.1.6 and 5.12.6 | Reflected XSS (documented attack attempts) | 7.1 (Patchstack), 6.1 (NVD) | CVE-2023-30777 | None (a logged-in user must click) |\n| January 17, 2024 | 6.2.5 | Stored XSS via the shortcode | 6.4 (Wordfence), 5.4 (NVD) | CVE-2023-6701 | Contributor |\n| May 30, 2024 | 6.3.0 | Reading fields via the shortcode | 6.5 (NVD) | CVE-2024-4565 | Contributor |\n| October 9, 2024 | 6.3.8, hardened in 6.3.9 | Limited function call | 5.4 (Patchstack), 6.6 (CISA) | CVE-2024-9529 | Administrator |\n| October 15, 2024 | 6.3.9 (affected: before 6.3.9, and Secure Custom Fields before 6.3.6.3) | Stored XSS in the field group editor | 5.3 (CISA) | CVE-2024-49593 | Administrator |\n| April 14, 2026 | 6.7.1 | Reading private content via AJAX | 5.3 (Wordfence) | CVE-2026-4812 | None (front-end form) |\n| May 27, 2026 | 6.8.2 | Changing fields via a front-end form | 5.3 (WPScan) | None | None |\n| May 30, 2026 | 6.8.2 | Changing post titles and content | 5.3 (Wordfence) | CVE-2026-8382 | None (front-end form) |\n\n*Notable ACF vulnerabilities published from January 1, 2020 to July 4, 2026 (CVE registry, plus one WPScan entry without a CVE)*\n\nDates are those of the first public advisory (for 2020, that of the fix). The score is the one from the organization that assigned the CVE, otherwise from NVD or CISA. Most vulnerabilities also affected ACF Pro, fixed in the same versions. Four vulnerabilities not in the table required an administrator account or access to the ACF settings: stored XSS or HTML injections in labels, fixed in 6.1.8 (2023), 6.3.6 and 6.3.9 (2024) and 6.4.3 (2025).\n\n## The notable vulnerabilities explained\n\n### July 2022: files uploaded without an account (CVE-2022-2594)\n\nJames Golovich (Pritect) discovered that, since the version 5.0 rewrite, the \"basic\" file upload fields in ACF front-end forms were not protected by a security token (nonce). On a site exposing such a form, an anonymous visitor could drop files: not PHP, which WordPress blocks, but any allowed type, usable according to the researcher for a later attack or phishing. Vendor contacted on July 11, 2022, version 5.12.3 released on the 14th, public advisory on the 25th: an exemplary timeline. NVD rates the vulnerability 8.8.\n\n### April 2023: PHP object injection by a contributor (CVE-2023-1196)\n\nACF unserialized some user-controllable data. A **Contributor** account could thus inject a PHP object, which only becomes dangerous when a \"gadget chain\" is provided by another plugin or the theme. Reported by Nguyen Huu Do through WPScan, the vulnerability is rated 8.8 by NVD. Versions 6.1.0 and 5.12.5, released on April 3 and 4, 2023, now forbid unserializing classes. The mechanism is detailed in our article on [PHP object injection](https://www.wp-masquerade.com/php-deserialization-object-injection/).\n\n### May 2023: the reflected XSS attacked in under 48 hours (CVE-2023-30777)\n\nRafie Muhammad of Patchstack found that the `post_status` parameter of the field groups screen was added to the admin page's CSS classes after a mere `sanitize_text_field`, which is insufficient because WordPress outputs these classes without escaping them. An attacker without an account could craft a link that, when opened by a logged-in administrator, ran JavaScript in their browser. Patchstack rates the vulnerability 7.1, NVD 6.1. This type of attack is explained in our article on XSS vulnerabilities in WordPress.\n\nReported on May 2, 2023, the vulnerability was fixed on May 4 in 6.1.6, with a fix backported to 5.12.6, and Patchstack published its analysis with a sample request on May 5. From May 6, Akamai observed significant scanning and attack attempt activity reusing **Patchstack's example word for word**, on sites in every sector. Akamai does not say whether any sites were compromised, and Patchstack stated on May 16 that it had not seen concrete attempts among its customers.\n\n### 2024: the ACF shortcode and output escaping\n\nThe `[acf]` shortcode was the weak spot from 2022 to 2024. In January 2024, Francesco Carlucci and Wordfence showed that a contributor without the `unfiltered_html` capability could save malicious HTML in a metadata field and display it through this shortcode (CVE-2023-6701, reported on December 12, 2023, fixed in 6.2.5 on January 16, 2024). In May, CVE-2024-4565 showed that the same shortcode displayed the fields of any post without checking permissions. The vendor went beyond the fix: shortcode **disabled by default** on new installations since 6.3.0, and removal of unsafe HTML by `the_field()` announced for 6.2.7.\n\n### 2026: front-end forms in the crosshairs\n\nThe three 2026 vulnerabilities have one thing in common: they target ACF front-end forms and require no account. CVE-2026-4812, reported by Fernando Mecozzi and published by Wordfence on April 14, made it possible to obtain information about drafts and private content through the AJAX requests of Relationship or Post Object fields, bypassing the configured restrictions. The fix, in 6.7.1, had been out since March 3. At the end of May, Sarawut Poolkhet published two vulnerabilities fixed in 6.8.2 (May 26): one allowed changing any field of the post linked to the form, even a field that was not displayed, the other overwriting its title and content (CVE-2026-8382). All are rated 5.3, but they affect the confidentiality or integrity of content without authentication.\n\n## October 2024: ACF taken over by WordPress.org\n\nThis episode mixes security and a legal dispute. On September 25, 2024, Matt Mullenweg announced on WordPress.org that WP Engine, in litigation with him, no longer had free access to the site's resources. The ACF team could no longer publish to the directory and set up its own update channel.\n\nOn October 7, ACF released version 6.3.8, which fixed a vulnerability reported by Automattic's security team (CVE-2024-9529): an administrator could have PHP functions executed through the callback functions of post types and taxonomies created with ACF, notably via settings import. The vendor describes it as an \"unlikely\" scenario between two administrators; Patchstack classifies it as low priority, \"unlikely to be exploited\". ACF says it sent a copy of the fix to the WordPress.org security team, which released it as 6.3.6.1.\n\nOn October 12, WordPress.org announced, on behalf of its security team, that it was invoking point 18 of the directory guidelines to create a fork of ACF named **Secure Custom Fields** (SCF), in order, it said, to fix a security issue and remove commercial upsells. Sites receiving automatic updates from WordPress.org were switched to SCF. The text speaks of a \"rare and unusual\" situation caused by WP Engine's legal actions. The ACF team replied the same day that a plugin under active development had never been taken from its creator without consent, called this code \"unauthorized\" and invited its users to download 6.3.8 from its website.\n\nThree days later, the same administrator-only stored XSS was fixed in both branches (CVE-2024-49593, ACF 6.3.9 and SCF 6.3.6.3): a fork also inherits the vulnerabilities of the original code. On December 10, 2024, a federal court in California issued a preliminary order to restore WP Engine's access to WordPress.org and its control of the ACF listing; Automattic sees it as a measure meant to preserve the status quo and is pursuing the case. In mid-December, the listing went back to WP Engine, while SCF continues under its own name, published by WordPress.org.\n\nFor a site owner, the lesson is not to pick a side, but to know **where your updates come from**: in October 2024, an automatic update could replace one plugin with another. Check whether you use ACF or SCF, and that this channel actually delivers the fixes to you. This distribution channel risk is covered in our article on supply chain attacks.\n\n*The switch from ACF to Secure Custom Fields presented by WP Minute on October 12, 2024 (in English).*\n\n## What this history shows\n\n![Chart of ACF vulnerabilities with a CVE per year according to the CVE registry: 1 medium in 2020, 1 high and 2 medium in 2021, 1 high, 1 medium and 1 low in 2022, 2 high and 1 medium in 2023, 5 medium in 2024, 1 low in 2025, 2 medium in 2026 up to July 4](https://www.wp-masquerade.com/media/2026/10/failles-par-annee-advanced-custom-fields-en.webp)\n\n*18 CVEs in six and a half years, none critical, with a peak in 2024.*\n\n- **No critical vulnerability, but unauthenticated ones**: eight of the nineteen vulnerabilities require no account from the attacker, whether through a booby-trapped link or, four times, through a front-end form.\n- **Access control keeps coming back**: reading data, fields or private content in 2021, 2022, 2024 and 2026. Each new way of displaying fields (shortcode, AJAX, form) had to be locked down after the fact.\n- **Intermediate roles matter**: four vulnerabilities only require a Contributor account. Keep these accounts to the strict minimum (see our article on roles and least privilege).\n- **Fixes are fast**: three days for the file upload in 2022, two days for the 2023 XSS. In April 2026, the fix preceded the advisory by six weeks.\n\nTo place ACF in the broader landscape, see our [timeline of WordPress core vulnerabilities](https://www.wp-masquerade.com/wordpress-core-vulnerabilities-timeline/) and our analysis of [plugin vulnerabilities by the numbers](https://www.wp-masquerade.com/wordpress-plugin-vulnerabilities-statistics/).\n\n## Protecting your site\n\n- **Update**: any version 6.8.2 or later fixes all the vulnerabilities in the table.\n- **Turn on automatic updates** for ACF (automatic plugin updates).\n- **Audit your front-end forms**: if you use `acf_form()`, limit the exposed fields with the `fields` option and remove those no longer needed. Leave the shortcode disabled if your theme does not use it.\n- **Remove unnecessary plugins**, including an ACF or SCF that is no longer used (abandoned plugins).\n- **Add a [web application firewall](https://www.wp-masquerade.com/glossary/waf/)** capable of virtual patching to cover the hours after an advisory (WAF comparison), and **monitor the vulnerabilities** of your plugins (monitoring plugin vulnerabilities).\n\nWP Masquerade Pro can help with this last point. Every day, it compares the versions of your installed plugins and themes with the public WPVulnerability.net database and sends you a [vulnerability alert](https://www.wp-masquerade.com/features/vulnerable-plugin-alerts/) by [email](https://www.wp-masquerade.com/features/email-alerts/) with the severity and the fixed version. The member area lists pending updates and vulnerable sites ([monitoring your sites](https://www.wp-masquerade.com/features/#surveillance)). WP Masquerade alerts, it does not fix plugins and it is not a firewall: updating remains your decisive step. To round out your toolkit, see our selection of the [best WordPress security plugins](https://www.wp-masquerade.com/best-wordpress-security-plugins/).\n\n### Key takeaways\n\n- 18 ACF vulnerabilities with a CVE from January 1, 2020 to July 4, 2026, none critical, all fixed.\n- The CVE-2023-30777 XSS was the target of attack attempts less than 48 hours after the fix.\n- Recommended minimum version: 6.8.2; install the latest.\n- Front-end forms (`acf_form()`) and the shortcode are the sensitive points: limit them.\n- Since October 2024, check whether you use ACF or Secure Custom Fields, and where your updates come from.\n\n## Sources\n\n- WordPress.org: Advanced Custom Fields (ACF®) plugin (https://wordpress.org/plugins/advanced-custom-fields/)\n- NVD: CVE-2022-2594 (August 22, 2022) (https://nvd.nist.gov/vuln/detail/CVE-2022-2594)\n- CVE.org: CVE-2023-30777 (May 10, 2023) (https://www.cve.org/CVERecord?id=CVE-2023-30777)\n- WordPress.org: WP Engine is banned from WordPress.org (September 25, 2024) (https://wordpress.org/news/2024/09/wp-engine-banned/)\n\nOther sources consulted: further CVE records, official vendor pages, security research publications, trade press articles, WPScan and Patchstack databases.\n\n## WordPress security, without the noise\n\nOne e-mail when something matters: new attacks seen in the wild, plugin updates and practical guides. No spam, unsubscribe in one click.", "categories": [ "Vulnerable plugins" ], "format": "application/json" }