Advanced Custom Fields (ACF) Pro

Versión 6.8.10 — 9 septiembre 2026

• Seguridad ACF now validates that uploaded PDF files begin with the standard %PDF- header before further processing, rejecting files that do not match the expected format
• Seguridad The Relationship, Post Object, Image, Gallery, and File fields now enforce WordPress read permissions on referenced posts and attachments when returned in REST API responses
• Seguridad ACF now verifies both preview context and the caller's edit capability before substituting revision data when field values are retrieved for a post
• Seguridad The _acf_form token used by frontend forms now expires and is bound to its issuing render, and acf_encrypt()/acf_decrypt() gain an optional $context argument for domain separation between token uses
• Seguridad ACF now consistently runs field validation on frontend form submissions containing field data, ensuring required-field checks and custom acf/validate_value filters cannot be circumvented
• Seguridad ACF's REST API schema no longer discloses per-object field-group configuration in OPTIONS requests to callers who lack read permission on the target object
• Seguridad The User field AJAX endpoint now validates that the request nonce was created for a User field

Versiones anteriores

• 6.8.9 (26 agosto 2026): 2 mejorado, 3 corregido, 1 other
• 6.8.8 (18 agosto 2026): 1 corregido
• 6.8.7 (3 agosto 2026): 6 seguridad