CVE-2026-8382

The Advanced Custom Fields (ACF®) plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.8.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to overwrite the post_title and post_content of any post bound to a publicly accessible acf_form() instance by injecting values into the _post_title and _post_content parameters of a form submission request.

• CWE-862

• https://plugins.trac.wordpress.org/browser/advanced-custom-fields/tags/6.8.0/includes/forms/form-front.php#L243
• https://plugins.trac.wordpress.org/changeset/3549586/advanced-custom-fields/trunk/includes/forms/form-front.php
• https://www.wordfence.com/threat-intel/vulnerabilities/id/ddb2290d-d4bd-4f70-9fe9-927f49721811?source=cve

Published

May 31, 2026

Last Modified

Jul 22, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-8376Perl versions through 5.43.10 have a heap buffer overflow wh…9.8
• CVE-2026-8377Missing Authorization vulnerability in Armiya Information Te…8.2
• CVE-2026-8378The Frontend File Manager Plugin WordPress plugin through 23…5.4
• CVE-2026-8379The Frontend File Manager Plugin WordPress plugin through 23…7.5
• CVE-2026-8380The Frontend File Manager Plugin WordPress plugin through 23…6.5
• CVE-2026-8381A broken access control vulnerability exists in the TeamView…5.4
• CVE-2026-8383The LearnPress WordPress plugin before 4.3.7 does not gate …5.3
• CVE-2026-8384In Eclipse Jetty, an HTTP URI of this form: /public;/..…5.3
• CVE-2026-8385The WP Go Maps WordPress plugin before 10.0.10 does not pro…5.3
• CVE-2026-8386The WP Go Maps WordPress plugin before 10.0.10 does not per…5.3
• CVE-2026-8387A vulnerability in allegroai/clearml versions up to and incl…2.4
• CVE-2026-8388Incorrect boundary conditions in the JavaScript Engine: JIT …6.5