Advanced Custom Fields version 6.8.10 is now available.

This release contains several security fixes for both ACF and ACF PRO.

We recommend that all users of ACF and ACF PRO upgrade as soon as possible.

Wrap Up

👨‍💻 Please find the release notes below. And for the latest ACF news, follow us on Twitter @wp_acf.

We take the security of ACF extremely seriously and are always working on protecting our users. If you have discovered a vulnerability in the code or have a security issue, please see our Security page for more information.

Changelog

  • Security – ACF now validates that uploaded PDF files begin with the standard %PDF- header before further processing, rejecting files that do not match the expected format
  • Security – The Relationship, Post Object, Image, Gallery, and File fields now enforce WordPress read permissions on referenced posts and attachments when returned in REST API responses
  • Security – ACF now verifies both preview context and the caller’s edit capability before substituting revision data when field values are retrieved for a post
  • Security – The _acf_form token used by frontend forms now expires and is bound to its issuing render, and acf_encrypt() / acf_decrypt() gain an optional $context argument for domain separation between token uses
  • Security – ACF now consistently runs field validation on frontend form submissions containing field data, ensuring required-field checks and custom acf/validate_value filters cannot be circumvented
  • Security – ACF’s REST API schema no longer discloses per-object field-group configuration in OPTIONS requests to callers who lack read permission on the target object
  • Security – The User field AJAX endpoint now validates that the request nonce was created for a User field

For questions and help about this release, please contact our support team.