Advanced Custom Fields version 6.8.7 is now available.

This release contains several security fixes for both ACF and ACF PRO.

We recommend that all users of ACF and ACF PRO upgrade as soon as possible.

Wrap Up

👨‍💻 Please find the release notes below. And for the latest ACF news, follow us on Twitter @wp_acf.

We take the security of ACF extremely seriously and are always working on protecting our users. If you have discovered a vulnerability in the code or have a security issue, please see our Security page for more information.

Changelog

  • Security – ACF Image and Gallery fields now enforce server-side validation to accept only image files
  • Security – The path attribute of registered ACF Blocks is now protected from being overridden by client-supplied block data
  • Security – ACF’s acf_encrypt() and acf_decrypt() helpers now authenticate encrypted values with an HMAC and no longer fall back to base64 encoding when OpenSSL is unavailable
  • Security – ACF’s comment, user, and options page form save handlers now only save values for fields whose field groups are assigned to the current save context
  • Security – The Post Object, Page Link, and Relationship field AJAX search queries now enforce WordPress read permissions, preventing unauthenticated visitors from seeing non-public post statuses or post types
  • Security – The User field now returns only user IDs in REST API responses to requesters without the list_users capability, preventing unauthenticated visitors from seeing user email addresses

For questions and help about this release, please contact our support team.