Advanced Custom Fields patched six vulnerabilities on August 4 — two of them quietly expose private content to unauthenticated visitors — and the version to be on is 6.8.8, not 6.8.7.
When a university client asks whether their restricted program pages are visible to the public, the answer is usually a routing question or a role-configuration question. After August 4, it became a plugin version question too.
On that date, Advanced Custom Fields released version 6.8.7 — a security-only update affecting both the free plugin and ACF PRO. It closes six distinct vulnerabilities. Most are narrow: server-side file-type enforcement on Image and Gallery fields, HMAC authentication added to ACF’s encrypt/decrypt helpers, block path attributes locked against client-supplied overrides, form save handlers scoped to their assigned field groups only. Routine hardening, important but unglamorous.
Two findings are less routine. First: AJAX search queries on Post Object and Relationship fields were not enforcing WordPress read permissions before this patch, which means non-public post statuses were visible to unauthenticated visitors — anyone who knew how to ask. Second: the User field was returning user IDs over REST to requesters who did not hold the list_users capability. For a health system with restricted content types or a nonprofit with role-gated data, these are not theoretical exposures.
AJAX search on Post Object and Relationship fields was not enforcing WordPress read permissions — non-public post statuses were visible to unauthenticated visitors who knew how to ask.
We build ACF-heavy sites for exactly the organizations this affects: health systems, universities, nonprofits. Restricted post types, authenticated user flows, content that is not meant for the open web. That context shapes how we read a security release. Both the permission bypass and the REST exposure are the kind of finding that requires a quick version check, not a committee meeting.
One wrinkle: ACF released 6.8.8 on August 19, two weeks after 6.8.7, to restore SVG support that the security patch had inadvertently blocked. If your site accepts SVG uploads in Image or Gallery fields, 6.8.7 alone is not where you want to land. The target version is 6.8.8. Any ACF installation short of that should be treated as unpatched.
Check your version, update to 6.8.8, and move on. That is the whole action item — and it is a small one relative to what it closes.