WP Vulnerability WatchVulnerability data as of September 7, 2026

Known vulnerabilities in Advanced Custom Fields (ACF®)

ACF helps customize WordPress with powerful, professional and intuitive fields. Proudly powering over 2 million sites, WordPress developers love ACF.

22Reported vulnerabilities
10Highest CVSS score
6.8.7Latest version
2,000,000+Active installs

What to do now

Update Advanced Custom Fields (ACF®) to 6.8.2 or later. 22 of these have a fixed version available. Updating resolves them.

Plugin last updated: August 4, 2026 / Tested up to WordPress: 7.0.4 / View on wordpress.org

Reported vulnerabilities

Ordered by how urgently they need attention — whether a vulnerability is actually being exploited, and how likely exploitation is, rather than CVSS severity alone.

CVESeverityExploit probability
next 30 days		 Affected versionsFixed inPublished
CVE-2023-30777 Medium 6.1 38.8% 5.8.10 to 5.12.5 (inclusive)
6.0.0 to 6.1.5 (inclusive)		 5.12.6 May 4, 2023
CVE-2022-2594 High 8.8 1.6% 5.0.0 up to (but not including) 5.12.3 5.12.3 August 22, 2022
CVE-2023-1196 High 8.8 1.1% 5.0.0 up to (but not including) 5.12.5
6.0.0 up to (but not including) 6.1.0		 5.12.5 May 2, 2023
CVE-2012-10025 Critical 10 1.3% 0 to 3.5.1 (inclusive) 3.5.2 August 5, 2025
CVE-2024-4565 Medium 6.5 0.4% Before 6.3 6.3 June 20, 2024
CVE-2021-20865 High 7.5 2.5% Before 5.11 5.11 December 2, 2021
CVE-2021-20866 Medium 6.5 1.7% Before 5.11 5.11 December 2, 2021
CVE-2022-23183 Medium 6.5 1.5% Before 5.12.1 5.12.1 March 30, 2022
CVE-2020-36172 Medium 6.1 0.9% Before 5.8.12 5.8.12 January 6, 2021
CVE-2018-20986 Medium 5.4 0.9% Before 5.7.8 5.7.8 August 22, 2019
CVE-2026-4812 Medium 5.3 0.9% 0 to 6.7.0 (inclusive) 6.7.1 April 15, 2026
CVE-2024-49593 Medium 5.3 0.5% 6.3.6.2 and earlier 6.3.6.3 October 17, 2024
CVE-2024-45429 Medium 5.5 0.4% 6.3.5 and earlier 6.3.6 September 4, 2024
CVE-2023-6701 Medium 5.4 0.5% 6.2.4 and earlier 6.2.5 February 5, 2024
CVE-2026-8382 Medium 5.3 0.5% 0 to 6.8.1 (inclusive) 6.8.2 May 31, 2026
WF-b061facb-0411-4b81-adbd-b1419b7210df Medium 5.3 — 6.8.1 and earlier 6.8.2 May 27, 2026
WF-5eab8a5d-8eb8-495f-a953-b468360cc5d5 Medium 5.4 — 5.7.11 and earlier 5.7.12 February 15, 2019
CVE-2024-9529 Medium 5.1 0.4% 6.3.6.2 and earlier 6.3.6.3 October 7, 2024
CVE-2023-40068 Medium 4.4 2.0% 6.1 to 6.1.7 (inclusive) 6.1.8 August 3, 2023
CVE-2021-20867 Medium 4.3 1.4% Before 5.11 5.11 December 2, 2021
CVE-2022-40696 Medium 4.3 0.5% 6.0.2 and earlier 6.0.3 October 18, 2022
CVE-2025-54940 Medium 4.1 0.2% 6.4.2 and earlier 6.4.3 August 8, 2025

Sources: vulnerability records from NVD, exploitation from CISA KEV, exploit probability from EPSS. Affected versions come from CPE ranges or from the reporting CNA.