What’s Vulnerable › Products

wpengine Advanced Custom Fields (ACF®) vulnerabilities

2 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 2 published in the last 12 months.

Check whether your wpengine Advanced Custom Fields (ACF®) version is affected

Latest wpengine Advanced Custom Fields (ACF®) vulnerabilities

• CVE-2026-8382 — Advanced Custom Fields (ACF®) <= 6.8.1 - Unauthenticated Arbitrary Post Modification via Front-End Form '_post_title' and '_post_content' Parameters (CVSS 5.3)
• CVE-2026-4812 — Advanced Custom Fields (ACF®) <= 6.7.0 - Unauthenticated Missing Authorization to Arbitrary Post/Page Disclosure via AJAX Field Query Parameters (CVSS 5.3)