CVE-2026-8382 is an authorization bypass vulnerability in the Advanced Custom Fields (ACF®) WordPress plugin, affecting all versions up to 6.8.1. The vulnerability arises because the plugin does not properly verify user authorization before allowing modification of post data via acf_form() instances that are publicly accessible. Attackers can exploit this by injecting values into the _post_title and _post_content parameters during form submission, resulting in unauthorized modification of post titles and content. The CVSS 3.1 score is 5.3 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and no availability impact. No official fix or patch has been disclosed yet.

An unauthenticated attacker can overwrite the title and content of any post associated with a publicly accessible acf_form() instance. This could lead to content tampering on affected WordPress sites using the vulnerable ACF plugin versions. There is no indication of confidentiality or availability impact. The integrity of post content is affected, which may impact site trustworthiness and content accuracy.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict public access to acf_form() instances or implement additional access controls to prevent unauthorized form submissions. Monitor for updates from the vendor and apply patches promptly once available.