WordPress News
Advanced Custom Fields (ACF®) 6.8.10 Released
What’s new in Advanced Custom Fields (ACF®) 6.8.10
Released: 2026-09-10
Active installations: 2,000,000
Tested up to WordPress 7.1
Requires PHP 7.4
Changelog
- Security – ACF now validates that uploaded PDF files begin with the standard %PDF- header before further processing, rejecting files that do not match the expected format
- Security – The Relationship, Post Object, Image, Gallery, and File fields now enforce WordPress read permissions on referenced posts and attachments when returned in REST API responses
- Security – ACF now verifies both preview context and the caller’s edit capability before substituting revision data when field values are retrieved for a post
- Security – The _acf_form token used by frontend forms now expires and is bound to its issuing render, and acf_encrypt() / acf_decrypt() gain an optional $context argument for domain separation between token uses
- Security – ACF now consistently runs field validation on frontend form submissions containing field data, ensuring required-field checks and custom acf/validate_value filters cannot be circumvented
- Security – ACF’s REST API schema no longer discloses per-object field-group configuration in OPTIONS requests to callers who lack read permission on the target object
- Security – The User field AJAX endpoint now validates that the request nonce was created for a User field
Previous releases
6.8.9
- View Release Post
- Enhancement – ACF Blocks registered via acf_register_block_type() or block.json without an explicit version now default to v3 on WordPress 7.1 or later. Blocks that specify a version continue to use the version they declare, and the default can be customized via the acf/blocks/default_block_version filter
- Enhancement – ACF Blocks v3 now supports a renderPreview option in block.json. Setting “renderPreview”: false shows a placeholder with the block’s icon, title, and an “Edit Block” button in the editor instead of rendering the block’s template as a live preview. The block continues to render normally on the front-end, and legacy v2 blocks combining “mode”: “edit” with “supports”: { “mode”: false } are automatically migrated when upgraded to v3
- Fix – Inline editable fields in ACF Blocks V3 no longer require a second click before they can be edited
- Fix – Radio buttons now appear correctly in ACF admin screens
6.8.8
- Fix – Image and Gallery fields no longer reject SVG files