CVE-2026-8382 describes an authorization bypass vulnerability in the Advanced Custom Fields (ACF®) WordPress plugin, affecting all versions up to and including 6.8.1. The vulnerability arises because the plugin does not properly verify user authorization before allowing modification of post data via acf_form() instances that are publicly accessible. An unauthenticated attacker can exploit this by injecting values into the _post_title and _post_content parameters of a form submission, thereby overwriting the title and content of posts. The issue is categorized under CWE-862 (Missing Authorization). The CVSS 3.1 score is 5.3 (medium), with attack vector network, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and no availability impact. No patch or official remediation level is currently documented.

An unauthenticated attacker can overwrite the post_title and post_content fields of any post associated with a publicly accessible acf_form() instance. This can lead to unauthorized content modification on affected WordPress sites using the vulnerable ACF plugin versions. There is no indication of confidentiality or availability impact. The integrity of post content can be compromised, potentially affecting site content trustworthiness.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict public access to acf_form() instances or implement additional access controls to prevent unauthorized form submissions that could modify post content.