WordPress News
Advanced Custom Fields (ACF®) 6.8.7 Released
What’s new in Advanced Custom Fields (ACF®) 6.8.7
Released: 2026-08-04
Active installations: 2,000,000
Tested up to WordPress 7.0.2
Requires PHP 7.4
Changelog
- Security – ACF Image and Gallery fields now enforce server-side validation to accept only image files
- Security – The path attribute of registered ACF Blocks is now protected from being overridden by client-supplied block data
- Security – ACF’s acf_encrypt() and acf_decrypt() helpers now authenticate encrypted values with an HMAC and no longer fall back to base64 encoding when OpenSSL is unavailable
- Security – ACF’s comment, user, and options page form save handlers now only save values for fields whose field groups are assigned to the current save context
- Security – The Post Object, Page Link, and Relationship field AJAX search queries now enforce WordPress read permissions, preventing unauthenticated visitors from seeing non-public post statuses or post types
- Security – The User field now returns only user IDs in REST API responses to requesters without the list_users capability, preventing unauthenticated visitors from seeing user email addresses
Previous releases
6.8.6
- Fix – Google Maps field values are no longer double-encoded when saved in an ACF block
- Fix – Inserting a Link field value in the Classic Editor no longer triggers validation for other required fields before the post is saved
- Fix – Auto Inline Editing blocks no longer return truthy placeholder strings for empty field values fetched from a different post inside the block render template
- Fix – ACF Blocks (V2 and V3) no longer crash when rendering an oEmbed field whose title begins with [ or {
- Fix – Field group location rules without a location value no longer cause PHP warnings on page load
6.8.5
- Security – ACF PRO’s save handler for WooCommerce order fields now verifies security nonces and only attaches on the order edit screen, preventing unauthenticated field value updates for stores utilizing HPOS
- Security – The Flexible Content “Rename Layout” modal no longer allows for the execution of a potential stored XSS vulnerability
- Security – A default limit of 1000 has been applied to user-contributed choices for Checkbox, Radio, and Select fields to improve security, with a new acf/fields/max_appended_choices filter available for customization
- Security – Special characters within LIKE patterns are now fully escaped in wp_options queries via $wpdb->esc_like()