Advanced Custom Fields v6.8.7

Release Date 4th August 2026

• Security - ACF Image and Gallery fields now enforce server-side validation to accept only image files
• Security - The path attribute of registered ACF Blocks is now protected from being overridden by client-supplied block data
• Security - ACF's acf_encrypt() and acf_decrypt() helpers now authenticate encrypted values with an HMAC and no longer fall back to base64 encoding when OpenSSL is unavailable
• Security - ACF's comment, user, and options page form save handlers now only save values for fields whose field groups are assigned to the current save context
• Security - The Post Object, Page Link, and Relationship field AJAX search queries now enforce WordPress read permissions, preventing unauthenticated visitors from seeing non-public post statuses or post types
• Security - The User field now returns only user IDs in REST API responses to requesters without the list_users capability, preventing unauthenticated visitors from seeing user email addresses