WordPress Plugin Vulnerabilities

Advanced Custom Fields 6.2.0 - 6.8.10 - Contributor+ Relationship Field Update on Arbitrary Objects via IDOR

Description

The plugin does not verify that a user is allowed to edit the target object before writing to it during bidirectional relationship synchronization, allowing users with contributor-level access and above to add or remove a reference to their own object on arbitrary posts, users, or terms they cannot otherwise edit.

Proof of Concept

Affects Plugins

Plugin icon
advanced-custom-fields
Fixed in 6.8.11

References

CVE
CVE-2026-97190

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
2.7 (low)

Miscellaneous

Original Researcher
vuxvinh
Submitter
vuxvinh
Verified
Yes
WPVDB ID
9e35af14-3981-4751-a08a-98431c1ac9cf

Timeline

Publicly Published
2026-11-04 (about 3 days ago)
Added
2026-11-04 (about 2 days ago)
Last Updated
2026-11-04 (about 2 days ago)

Other

Published
Title
Published
2026-09-10
Title
Rox Appointment Booking 1.0.9 - 1.2.2 - Unauthenticated Customer PII Disclosure via IDOR
Published
2026-09-17
Title
Hydra Booking < 1.2.2 - Hydra Host+ Cross-Host Booking Deletion and Modification via IDOR
Published
2026-04-16
Title
LatePoint < 5.4.0 - Insecure Direct Object Reference to Unauthenticated Sensitive Financial Data Exposure via Sequential Invoice ID
Published
2022-11-16
Title
Directorist < 7.4.2.2 - Subscriber+ Arbitrary User Password Update via IDOR
Published
2025-02-11
Title
Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin < 1.0.6 - Authenticated (Subscriber+) Insecure Direct Object Reference