CVE-2026-8382 Overview
CVE-2026-8382 is an authorization bypass vulnerability in the Advanced Custom Fields (ACF®) plugin for WordPress, affecting all versions up to and including 6.8.1. The plugin fails to verify that a user is authorized to perform an action when processing acf_form() submissions. Unauthenticated attackers can overwrite the post_title and post_content of any post bound to a publicly accessible acf_form() instance by injecting values into the _post_title and _post_content parameters. The flaw is tracked as CWE-862: Missing Authorization.
Critical Impact
Unauthenticated attackers can modify titles and content of arbitrary posts bound to public ACF forms, enabling content tampering and defacement.
Affected Products
- Advanced Custom Fields (ACF®) plugin for WordPress — all versions through 6.8.1
- Advanced Custom Fields Pro (shares the same form-front.php codebase)
- WordPress sites exposing acf_form() instances to unauthenticated visitors
Discovery Timeline
- 2026-05-31 - CVE-2026-8382 published to NVD
- 2026-06-01 - Last updated in NVD database
Technical Details for CVE-2026-8382
Vulnerability Analysis
The Advanced Custom Fields plugin provides the acf_form() function so developers can render front-end forms that let authorized users edit ACF custom fields on a post. The form submission handler in includes/forms/form-front.php processes hidden _post_title and _post_content parameters and writes them back to the underlying post. The handler does not check whether the requester has the WordPress capability required to edit the target post. Any visitor who can reach a page rendering an acf_form() instance can submit crafted parameters and overwrite the bound post's title and body. The integrity impact is limited to those two fields, but the vulnerability is reachable over the network without authentication or user interaction.
Root Cause
The root cause is a missing authorization check [CWE-862] in the front-end form submission logic. The handler trusts the form's binding to a post identifier and applies the submitted _post_title and _post_content values without calling current_user_can( 'edit_post', $post_id ) or an equivalent capability gate. The fix landed in changeset 3549586, which adds capability verification before persisting submitted values. The pre-patch flow is visible in the vulnerable form-front.php source.
Attack Vector
An attacker locates any public page that embeds an acf_form() instance bound to a post. The attacker issues a POST request to that page containing the form's nonce and ACF fields, plus _post_title and _post_content values of their choice. The plugin writes those values to the bound post without validating that the unauthenticated requester is allowed to edit it. Exploitation requires no credentials, no user interaction, and only knowledge of a reachable form endpoint. See the Wordfence advisory for additional analysis.
Detection Methods for CVE-2026-8382
Indicators of Compromise
- POST requests to pages containing acf_form() instances with _post_title or _post_content parameters from unauthenticated sessions.
- Unexpected revisions to wp_posts where post_author does not match the original editor or revisions originate without a logged-in user context.
- Defacement strings, injected links, or SEO spam appearing in titles or bodies of posts bound to ACF front-end forms.
- Spikes in traffic to known ACF form URLs from a narrow set of source IPs.
Detection Strategies
- Inventory all pages that call acf_form() and monitor their request logs for submissions lacking authenticated session cookies.
- Compare post_modified timestamps against expected editorial workflows to flag out-of-band changes.
- Alert on WordPress audit log entries showing post updates with no associated user ID on sites running ACF <= 6.8.1.
Monitoring Recommendations
- Forward WordPress and web server logs to a centralized analytics platform and build queries for the _post_title and _post_content parameter names.
- Enable WordPress revision history and review revisions on posts tied to public ACF forms.
- Monitor file integrity for wp-content/plugins/advanced-custom-fields/ to confirm the patched version is deployed.
How to Mitigate CVE-2026-8382
Immediate Actions Required
- Upgrade the Advanced Custom Fields plugin to a version newer than 6.8.1 that includes changeset 3549586.
- Audit posts bound to public acf_form() instances for unauthorized modifications to titles and content.
- Restrict acf_form() rendering to authenticated users where possible by wrapping the call with is_user_logged_in() checks.
Patch Information
The vendor fix is published in WordPress plugin changeset 3549586, which adds the missing authorization check in includes/forms/form-front.php. Site operators should update through the WordPress plugin manager or by deploying the patched plugin package from the official repository. Confirm the installed version reports higher than 6.8.1 after the update.
Workarounds
- Remove or gate acf_form() calls behind authentication until the patched plugin is deployed.
- Add a web application firewall rule that blocks POST requests containing _post_title or _post_content parameters to URLs that should not accept post edits.
- Set ACF form configurations so they are not bound to existing post IDs, preventing overwrite of published content.
- Disable front-end editing features in the plugin configuration if they are not in active use.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
