Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The Advanced Custom Fields (ACF®) plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.8.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to overwrite the post_title and post_content of any post bound to a publicly accessible acf_form() instance by injecting values into the _post_title and _post_content parameters of a form submission request.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-8382 Authorization Bypass in Advanced Custom Fields Plugin for WordPress Up to 6.8.1 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-8382
Post summary
The item announces the discovery of an authorization bypass vulnerability (CVE‑2026‑8382) affecting the Advanced Custom Fields WordPress plugin up to version 6.8.1, providing basic technical details but no PoC, exploit code, or patch information.