WordPress News
Advanced Custom Fields (ACF®) 6.8.6 Released
What’s new in Advanced Custom Fields (ACF®) 6.8.6
Released: 2026-07-14
Active installations: 2,000,000
Tested up to WordPress 7.0.2
Requires PHP 7.4
Changelog
- Fix – Google Maps field values are no longer double-encoded when saved in an ACF block
- Fix – Inserting a Link field value in the Classic Editor no longer triggers validation for other required fields before the post is saved
- Fix – Auto Inline Editing blocks no longer return truthy placeholder strings for empty field values fetched from a different post inside the block render template
- Fix – ACF Blocks (V2 and V3) no longer crash when rendering an oEmbed field whose title begins with [ or {
- Fix – Field group location rules without a location value no longer cause PHP warnings on page load
- Fix – The appearance of the URL, Number, and Select fields has been improved on WordPress 7.0+
- Fix – ACF fields now save on WooCommerce orders when using HPOS in compatibility mode
Previous releases
6.8.5
- Security – ACF PRO’s save handler for WooCommerce order fields now verifies security nonces and only attaches on the order edit screen, preventing unauthenticated field value updates for stores utilizing HPOS
- Security – The Flexible Content “Rename Layout” modal no longer allows for the execution of a potential stored XSS vulnerability
- Security – A default limit of 1000 has been applied to user-contributed choices for Checkbox, Radio, and Select fields to improve security, with a new acf/fields/max_appended_choices filter available for customization
- Security – Special characters within LIKE patterns are now fully escaped in wp_options queries via $wpdb->esc_like()
6.8.4
- Security – ACF AJAX field handlers now validate that the request nonce was created for the expected field type
- Enhancement – ACF PRO now satisfies plugin dependencies declared against advanced-custom-fields, so plugins requiring ACF can activate when only ACF PRO is installed
- Enhancement – acf_inline_toolbar_editing_attrs() now accepts a return_array argument that returns the attributes as an escaped array suitable for use with wp_get_attachment_image()
- Fix – acf_form() with ‘post_id’ => ’new_post’ and a fields list of field names no longer fatal errors when acf_form_head() runs before WordPress’s main query is built
- Fix – Multiple acf_form() calls wrapped inside a single outer tag with one submit button no longer silently drop field values, post_title, or post_content from the non-last forms