WordPress News
Advanced Custom Fields (ACF®) 6.8.9 Released
What’s new in Advanced Custom Fields (ACF®) 6.8.9
Released: 2026-08-27
Active installations: 2,000,000
Tested up to WordPress 7.1
Requires PHP 7.4
Changelog
- View Release Post
- Enhancement – ACF Blocks registered via acf_register_block_type() or block.json without an explicit version now default to v3 on WordPress 7.1 or later. Blocks that specify a version continue to use the version they declare, and the default can be customized via the acf/blocks/default_block_version filter
- Enhancement – ACF Blocks v3 now supports a renderPreview option in block.json. Setting “renderPreview”: false shows a placeholder with the block’s icon, title, and an “Edit Block” button in the editor instead of rendering the block’s template as a live preview. The block continues to render normally on the front-end, and legacy v2 blocks combining “mode”: “edit” with “supports”: { “mode”: false } are automatically migrated when upgraded to v3
- Fix – Inline editable fields in ACF Blocks V3 no longer require a second click before they can be edited
- Fix – Radio buttons now appear correctly in ACF admin screens
- Fix – Image and Gallery fields no longer reject SVG uploads when the Safe SVG plugin is active
Previous releases
6.8.8
- Fix – Image and Gallery fields no longer reject SVG files
6.8.7
- Security – ACF Image and Gallery fields now enforce server-side validation to accept only image files
- Security – The path attribute of registered ACF Blocks is now protected from being overridden by client-supplied block data
- Security – ACF’s acf_encrypt() and acf_decrypt() helpers now authenticate encrypted values with an HMAC and no longer fall back to base64 encoding when OpenSSL is unavailable
- Security – ACF’s comment, user, and options page form save handlers now only save values for fields whose field groups are assigned to the current save context
- Security – The Post Object, Page Link, and Relationship field AJAX search queries now enforce WordPress read permissions, preventing unauthenticated visitors from seeing non-public post statuses or post types