CVE-2026-8382: Wpengine Advanced Custom Fields Acf

Medium severity, CVSS 5.3. EPSS: 0.5% chance of exploitation in the next 30 days.

The Advanced Custom Fields (ACF®) plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.8.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to overwrite the post_title and post_content of any post bound to a publicly accessible acf_form() instance by injecting values into the _post_title and _post_content parameters of a form submission request.

Affected products

• Wpengine Advanced Custom Fields Acf: up to and including 6.8.1

Published 2026-05-31. Last modified 2026-07-22.