ACF 6.8.7 Security Release: Breaking Down Key Patch Updates and Technical Fixes

Technical Overview of the ACF 6.8.7 Release

The Advanced Custom Fields (ACF) engineering team has released version 6.8.7 for both free and PRO editions. This update addresses several security vectors across file upload handlers, custom block registration, encryption helpers, contextual form persistence, AJAX queries, and REST API data serialization. Developers maintaining WordPress installations utilizing ACF or ACF PRO are urged to apply this update immediately to maintain compliance with established security standards and eliminate exposure to unauthorized data access or input manipulation.

Server-Side Validation for Image and Gallery Fields

Prior iterations of file-handling fields in custom forms or admin interfaces risked vulnerabilities if file extension and MIME type validation relied too heavily on client-side controls or loose format checks. In ACF 6.8.7, strict server-side validation is enforced specifically on Image and Gallery fields.

When users transmit assets through these fields, the plugin verifies that the submitted files genuinely match allowed image formats before saving or processing the upload on the server. This prevents malicious actors from bypassing front-end restriction layers to upload non-image formats, such as executable scripts or unexpected file extensions, under the guise of an image upload context.

Securing ACF Block Attributes Against Path Overriding

Custom ACF Blocks rely on registered attributes, including path configurations that determine template rendering and script loading. In vulnerable configurations, client-supplied block data inside Gutenberg request payloads could potentially manipulate or override internal block metadata.

ACF 6.8.7 introduces explicit protection for the block path attribute. By preventing client-supplied block data from overriding internal path definitions, the update ensures that block template paths remain immutable during rendering, protecting custom themes and block architectures from arbitrary template inclusion vectors.

Cryptographic Hardening: HMAC Authentication for Helper Functions

ACF provides utility functions—acf_encrypt() and acf_decrypt()—to secure sensitive string values stored in the database or passed between application layers. Previous versions allowed a fallback mechanism to base64 encoding when the server lacked an active OpenSSL extension, which provided no actual cryptographic protection.

In version 6.8.7, two critical cryptographic upgrades are introduced:

• HMAC Authentication: All encrypted strings processed via acf_encrypt() and verified via acf_decrypt() are now authenticated with a Hash-based Message Authentication Code (HMAC). This guarantees data integrity and authenticity, preventing ciphertext tampering.
• Removal of Insecure Fallback: ACF no longer falls back to base64 encoding when OpenSSL is unavailable on the host environment, requiring proper cryptographic libraries to perform encryption operations safely.

Contextual Field Group Validation on Form Saves

ACF allows field groups to be conditionally assigned to various WordPress submission locations, including user profiles, options pages, and comment forms. Under certain request conditions, submission handlers might accept field input regardless of whether the target field group was explicitly authorized for that target location.

With ACF 6.8.7, form save handlers for comments, user profiles, and options pages rigorously evaluate the current save context. Field values are saved only if their corresponding field group is explicitly assigned to that specific context, preventing unauthorized parameters from injecting arbitrary meta keys into user, comment, or options data tables.

Enforcing WordPress Read Permissions in Relational Field AJAX Searches

Relational controls such as the Post Object, Page Link, and Relationship fields utilize background AJAX endpoints to power live search functionality in the WordPress admin and custom forms. If query handlers lack comprehensive capability checks, unauthenticated or low-privilege visitors might query non-public content via these endpoints.

The 6.8.7 release fixes this by enforcing standard WordPress read permissions and visibility checks across all Post Object, Page Link, and Relationship AJAX search handlers. Requests from unauthenticated clients or users lacking adequate permissions can no longer view titles, post types, or non-public post statuses (such as drafts, pending posts, or private entries).

REST API Privacy Enforcement for the User Field

When ACF fields are exposed through the WordPress REST API, field values are automatically serialized into the response payload. In earlier configurations, querying an ACF User field via REST API could expose user meta fields, including email addresses, to unauthenticated API clients.

ACF 6.8.7 implements capability-aware serialization for the User field in REST API endpoints:

• Requesters possessing the list_users capability receive full user object responses as authorized.
• Requesters without the list_users capability (including unauthenticated visitors) receive only numeric user IDs.

This ensures that email addresses and personal user data remain protected against automated scrapers and unauthorized REST API queries.

Practical Upgrade Steps and Implementation Details

To implement this update safely across development, staging, and production environments, developers should execute the following sequence:

• Confirm that the server hosting WordPress has the PHP OpenSSL extension enabled to ensure seamless operation of acf_encrypt() and acf_decrypt().
• Update ACF or ACF PRO to version 6.8.7 via the WordPress plugin dashboard or WP-CLI (wp plugin update advanced-custom-fields-pro).
• Audit any custom implementations relying on REST API output for User fields to verify that non-administrative consumers gracefully handle standard user IDs instead of full user objects.
• Verify front-end form submissions containing Image and Gallery fields to confirm server-side MIME checks pass valid asset uploads without issue.

Primary reference: Review the original announcement for exact release details. This article is an independent explanation and does not reproduce the source text.