---
title: "Advanced Custom Fields"
description: "ACF free or PRO: strengths, limitations, pricing, recommended settings (REST API, shortcode, Local JSON) and patched vulnerabilities, to choose well."
language: "en"
locale: "en-US"
type: "plugin-sheet"
canonical: "https://www.wp-masquerade.com/features/camouflaged-plugins/advanced-custom-fields/"
published: "2026-11-04T08:00:00+00:00"
modified: "2026-11-05T20:57:24+00:00"
translations:
  en-US: "https://www.wp-masquerade.com/features/camouflaged-plugins/advanced-custom-fields/index.md"
  fr-FR: "https://www.wp-masquerade.com/fr/fonctionnalites/extensions-camouflees/advanced-custom-fields/index.md"
  es-ES: "https://www.wp-masquerade.com/es/funcionalidades/plugins-camuflados/advanced-custom-fields/index.md"
  de-DE: "https://www.wp-masquerade.com/de/funktionen/getarnte-plugins/advanced-custom-fields/index.md"
  it-IT: "https://www.wp-masquerade.com/it/funzionalita/plugin-camuffati/advanced-custom-fields/index.md"
  pt-BR: "https://www.wp-masquerade.com/pt/recursos/plugins-wordpress-camuflados/advanced-custom-fields/index.md"
  nl-NL: "https://www.wp-masquerade.com/nl/functies/gecamoufleerde-plugins/advanced-custom-fields/index.md"
---

# Advanced Custom Fields

Advanced Custom Fields (ACF) adds custom fields, post types and taxonomies to WordPress without writing PHP configuration. Our take on the free version and ACF PRO, the settings that limit what the plugin exposes and the recent vulnerabilities worth knowing about.

## The essentials

- Best for custom themes and catalogs that need structured fields and their own post types.
- Main caveat: Repeater, Flexible Content, Gallery, Options Pages and ACF Blocks require ACF PRO.
- Free; ACF PRO costs $49 per year for one site or $149 for ten sites, plus taxes.

## What Advanced Custom Fields does in WordPress

Advanced Custom Fields (ACF) adds custom fields to WordPress edit screens: a price, a date, an address, an image or a relationship to another piece of content. You build field groups in the ACF menu, pick from more than 30 field types, then use location rules to decide where they show up: posts, pages, users, taxonomy terms, media, comments. Values are stored as metadata in the WordPress database.

ACF does not lay anything out on its own. Your theme outputs the values with PHP functions such as `get_field()` and `the_field()`, or, for simple text values, through block bindings and the `[acf]` shortcode. The free version also lets you register post types and taxonomies right in the admin, with no code and no extra plugin. Since version 6.8 it can optionally output JSON-LD structured data and ships `wp acf json` WP-CLI commands.

The plugin is published by WP Engine. ACF PRO, a separate plugin sold as a yearly license, adds the Repeater field, Flexible Content, Gallery, the Clone field, Options Pages and ACF Blocks for the block editor.

![Diagram: Advanced Custom Fields works on visitors and bots, wordpress, database and files. Public traces: folder name (hidden with Pro); tag IDs (hidden with Pro); JavaScript variables (still visible).](https://www.wp-masquerade.com/media/wpm-sheets/acf/diagram-en.svg?v=a664c9a1)

## Which projects ACF is a good fit for

ACF is built for content that does not fit into a plain title and body:

- **Custom themes built by agencies and freelancers**: the client fills in clear fields while the theme controls the layout.
- **Catalogs and directories**: real estate listings, team profiles, events, case studies, with the post type and its fields defined in one place.
- **Headless sites**: each field group can be exposed in the REST API, one group at a time.
- **Teams that version their code**: Local JSON saves the configuration to files tracked in git.

ACF is the wrong pick if nobody will write PHP in the theme: without a template that reads the fields, the values you enter stay hidden outside of block bindings. If you only need to register post types without fields, [Custom Post Type UI](https://www.wp-masquerade.com/features/camouflaged-plugins/custom-post-type-ui/) is enough; for a code-first fields framework, compare it with [Meta Box](https://www.wp-masquerade.com/features/camouflaged-plugins/meta-box/).

## ACF strengths and limitations

### Strengths

- **A generous free version.** More than 30 field types that attach to almost every WordPress object.
- **Post types and taxonomies without code.** The whole content model can be built from the ACF menu.
- **Configuration you can version.** Local JSON and the `wp acf json` commands make moving from staging to production easier.
- **REST API on demand.** No group is exposed by default, so you decide what goes out.
- **Frequent security fixes.** The 2026 6.8.x releases hardened forms, AJAX queries and the shortcode.

### Limitations

- **Repeatable fields cost extra.** Repeater, Flexible Content, Gallery, Clone, Options Pages and ACF Blocks all require ACF PRO.
- **Output takes code.** The shortcode only handles simple text values; everything else goes through the theme.
- **Tight coupling with the theme.** Your data stays in the database if you deactivate ACF, but a template that calls `get_field()` without a safety check then throws a fatal error.
- **Public forms need care.** The 2026 vulnerabilities mostly targeted `acf_form()` forms open to visitors.

## The ACF settings we recommend

Group settings sit below the field list on the field group edit screen; field settings live in each field's tabs. The last two rows are set in your theme code, on the `acf/init` hook.

| Setting | Recommended value | Why |
| --- | --- | --- |
| **Show in REST API**  ACF > Field Groups > your group > Group Settings | Off (default), except on a headless site | When on, the group's values appear in `/wp-json/` responses. |
| **Location Rules**  Same screen, Location Rules tab | Only the content types that need the fields | Since 6.8.11, ACF discards submitted values for a field whose rules do not match the content being saved, so tight rules limit what can be written. |
| **Allow Access to Value in Editor UI**  Field > Presentation tab | Off, except for fields shown through block bindings or the shortcode | Off by default on new fields, but on by default for fields created before it appeared in 6.3.6. |
| **Return Format** (Image field) Field > General tab | Image ID | Your theme can then use `wp_get_attachment_image()`, which outputs responsive images with `srcset`. |
| **Local JSON**  `acf-json` folder in the theme root | Created, writable, tracked in git | Every save writes a file there; the "Sync available" tab imports changes on another site. |
| **`[acf]` shortcode**  Code: `acf_update_setting( 'enable_shortcode', false )` | Off if you do not use it | Off by default on installs made since ACF 6.3, it may still be on for older sites; when on, any user who can publish can display any field. |
| **ACF menu**  Code: `acf_update_setting( 'show_admin', false )` | Hidden in production, if your groups are versioned with Local JSON | A client with an admin account can no longer edit or delete a field group by mistake. |

- Open `/wp-json/wp/v2/posts`: an `acf` key should only appear for groups you exposed on purpose.
- Save a field group: a `.json` file should appear in the theme's `acf-json` folder.
- Put `[acf field="field_name"]` in a draft and preview it: if nothing shows, the shortcode is off.
- Under Plugins, check that you run the latest version and that auto-updates are enabled.

## ACF security: public forms are the front line

The most serious ACF vulnerabilities affect logged-out visitors, often through an `acf_form()` form on the public site. Three verified examples:

- **CVE-2023-30777, fixed in 6.1.6**: a reflected [XSS](https://www.wp-masquerade.com/glossary/xss/) flaw exploitable without an account, in ACF and ACF PRO up to 6.1.5.
- **CVE-2026-4812, fixed in 6.7.1**: a visitor with access to a public ACF form could list drafts, private content and restricted post types through the AJAX queries of relationship fields.
- **CVE-2026-8382, fixed in 6.8.2**: a visitor could overwrite the title and content of a post tied to a public `acf_form()` form.

Versions 6.8.7, 6.8.10 and 6.8.11 then tightened file uploads, REST API responses and the shortcode. So turn on auto-updates for ACF (see our guide to plugin auto-updates), keep the REST API to what you actually need ([what the REST API makes public](https://www.wp-masquerade.com/wordpress-rest-api-security/)) and read the full timeline in our article on [ACF security vulnerabilities](https://www.wp-masquerade.com/advanced-custom-fields-security-vulnerabilities/). ACF only adds its scripts to public pages for certain uses, such as these forms: WP Masquerade Pro then renames the plugin folder and its script IDs, which makes it harder for bots to spot, without replacing updates.

## Advanced Custom Fields FAQ

**Is the free version of ACF enough?**

Yes, as long as each field appears once per post: text, image, date, relationship, post types and taxonomies are all free. As soon as you need a list of variable length, layouts editors can assemble, a gallery, an options page or ACF Blocks, you need ACF PRO.

**How much does ACF PRO cost?**

The official page lists $49 per year for one site, $149 for ten sites and $249 for unlimited sites, plus taxes. Every license includes all PRO features and a year of updates, and auto-renewal can be turned off.

**Should I keep the free ACF plugin after installing ACF PRO?**

No. The free version is deactivated automatically when you activate ACF PRO, your data is kept and you can delete it. Then enter your license key under ACF > Updates, otherwise ACF PRO stops receiving updates.

**What is the difference between ACF and Secure Custom Fields?**

Secure Custom Fields is a fork of ACF that WordPress.org has published since October 2024; ACF itself is still developed and published by WP Engine. They are two separate plugins: pick one and do not run both on the same site.

## Key facts

- Category: Utilities
- Vendor: WP Engine
- Price: Free; ACF PRO from $49 per year for one site, plus taxes
- Active installations (wordpress.org): 2 000 000+
- Version: 6.8.11
- Official page: https://wordpress.org/plugins/advanced-custom-fields/

## What WP Masquerade hides

- Handled by the free version of WP Masquerade
- With Pro: folder name, tag IDs
- Still visible: JavaScript variables