WordPress Plugin Vulnerabilities

Advanced Custom Fields < 6.8.11 - Contributor+ Unpublished Post Title and Status Disclosure via Relational Fields

Description

The plugin does not perform a read-permission check when it renders and formats the values of its relational fields, allowing users with post-editing access (Contributor and above) to disclose the titles and non-public statuses of other users' unpublished posts.

Proof of Concept

Affects Plugins

Plugin icon
advanced-custom-fields
Fixed in 6.8.11

References

CVE
CVE-2026-97189

Classification

Type
SENSITIVE DATA DISCLOSURE
OWASP top 10
A3: Sensitive Data Exposure
CWE
CWE-200
CVSS
2.7 (low)

Miscellaneous

Original Researcher
vuxvinh
Submitter
vuxvinh
Verified
Yes
WPVDB ID
694a3ef1-a4b8-41fc-9630-134d549b4176

Timeline

Publicly Published
2026-11-04 (about 3 days ago)
Added
2026-11-04 (about 2 days ago)
Last Updated
2026-11-04 (about 2 days ago)

Other

Published
Title
Published
2024-01-03
Title
Coupon Referral Program < 1.8.5 - Sensitive Information Disclosure
Published
2025-02-28
Title
Fluent Support – Helpdesk & Customer Support Ticket System < 1.8.6 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory
Published
2020-08-10
Title
File Manager < 6.5 - Backup File Directory Listing
Published
2024-03-28
Title
Wholesale For WooCommerce < 2.3.1 - Unauthenticated Information Exposure
Published
2025-08-05
Title
GiveWP – Donation Plugin and Fundraising Platform < 4.6.1 - Unauthenticated Donor Data Exposure