WordPress News
Advanced Custom Fields (ACF®) 6.8.8 Released
What’s new in Advanced Custom Fields (ACF®) 6.8.8
Released: 2026-08-19
Active installations: 2,000,000
Tested up to WordPress 7.1
Requires PHP 7.4
Changelog
- Fix – Image and Gallery fields no longer reject SVG files
Previous releases
6.8.7
- Security – ACF Image and Gallery fields now enforce server-side validation to accept only image files
- Security – The path attribute of registered ACF Blocks is now protected from being overridden by client-supplied block data
- Security – ACF’s acf_encrypt() and acf_decrypt() helpers now authenticate encrypted values with an HMAC and no longer fall back to base64 encoding when OpenSSL is unavailable
- Security – ACF’s comment, user, and options page form save handlers now only save values for fields whose field groups are assigned to the current save context
- Security – The Post Object, Page Link, and Relationship field AJAX search queries now enforce WordPress read permissions, preventing unauthenticated visitors from seeing non-public post statuses or post types
6.8.6
- Fix – Google Maps field values are no longer double-encoded when saved in an ACF block
- Fix – Inserting a Link field value in the Classic Editor no longer triggers validation for other required fields before the post is saved
- Fix – Auto Inline Editing blocks no longer return truthy placeholder strings for empty field values fetched from a different post inside the block render template
- Fix – ACF Blocks (V2 and V3) no longer crash when rendering an oEmbed field whose title begins with [ or {
- Fix – Field group location rules without a location value no longer cause PHP warnings on page load