Description
The Advanced Custom Fields (ACF®) WordPress plugin before 6.8.11 does not verify that a user is allowed to edit the target object before writing to it during bidirectional relationship synchronization, allowing users with contributor-level access and above to add or remove a reference to their own object on arbitrary posts, users, or terms they cannot otherwise edit.
Published: 2026-11-07
Score: n/a
EPSS: n/a
KEV: No
Impact: Unauthorized Modification by Contributor-level Users
Action: Apply Patch
AI Analysis

Impact

The vulnerability permits authenticated contributors to add or remove references in bidirectional relationship fields on any WordPress content types, including posts, users, or terms, without the system verifying edit permissions. This leads to unauthorized modification of data that the user normally could not edit.

Affected Systems

The affected product is the Advanced Custom Fields WordPress plugin version 6.2.0 through 6.8.10, which is widely deployed to extend metadata fields in WordPress sites.

Risk and Exploitability

Exploitability is high because attackers only need contributor-level access, which is commonly available on many sites. The CVSS score is not listed, EPSS is unavailable, and the vulnerability is not on the CISA KEV catalog, but the lack of permission checks makes this a serious risk for sites that use these relationships.

Generated by OpenCVE AI on November 7, 2026 at 08:11 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to Advanced Custom Fields 6.8.11 or later to include the authorization check.
  • Limit the contributor role by removing or restricting the capability to edit posts, users, or terms that are linked via bidirectional relationships.
  • If an upgrade is not immediately possible, disable or remove the Relationship field from content types that contain arbitrary object references to prevent modifications.

Generated by OpenCVE AI on November 7, 2026 at 08:11 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 07 Nov 2026 08:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
CWE-639

Sat, 07 Nov 2026 06:15:00 +0000

Type Values Removed Values Added
Description The Advanced Custom Fields (ACF®) WordPress plugin before 6.8.11 does not verify that a user is allowed to edit the target object before writing to it during bidirectional relationship synchronization, allowing users with contributor-level access and above to add or remove a reference to their own object on arbitrary posts, users, or terms they cannot otherwise edit.
Title Advanced Custom Fields 6.2.0 - 6.8.10 - Contributor+ Relationship Field Update on Arbitrary Objects via IDOR
References

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: WPScan

Published:

Updated: 2026-11-07T06:00:24.290Z

Reserved: 2026-09-24T08:42:29.891Z

Link: CVE-2026-97190

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-11-07T06:16:59.617

Modified: 2026-11-07T06:16:59.617

Link: CVE-2026-97190

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-07T08:15:03Z

Weaknesses
  • CWE-284

    Improper Access Control

  • CWE-639

    Authorization Bypass Through User-Controlled Key