The Advanced Custom Fields plugin fails to re‑apply its field‑group location rules when a post is saved, permitting users with contributor level or higher to write custom field values that should be restricted to administrators. This allows those users to inject or modify data that is otherwise protected by the plugin’s intended access controls, effectively bypassing the intended restriction on custom fields. The impact is an escalation of privileges because contributors can alter or create data that should only be managed by administrators, potentially affecting site content, configuration, or exposing sensitive data.

The vulnerability affects installations of the Advanced Custom Fields WordPress plugin version 6.8.10 and earlier. Any WordPress site using the aforementioned plugin and having contributors or higher roles enabled is at risk. No specific WordPress core versions are implicated in the description, so the primary focus is the plugin itself.

The inability to re‑apply location rules represents an authorization flaw that can be exploited by any contributor or higher role on the site. Because the vulnerability is triggered during the standard post editor save action, attackers do not require additional privileges beyond those already granted to contributors. The EPSS score is not provided, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, the flaw allows privileged escalation within the plugin context and can have significant consequences if the injected custom fields influence published content or internal site logic. The most likely attack vector is the normal post editing interface that contributors normally use.