CVE-2026-97190
📛 CVE Title
Advanced Custom Fields 6.2.0 - 6.8.10 - Contributor+ Relationship Field Update on Arbitrary Objects via IDOR
Description
The Advanced Custom Fields (ACF®) WordPress plugin before 6.8.11 does not verify that a user is allowed to edit the target object before writing to it during bidirectional relationship synchronization, allowing users with contributor-level access and above to add or remove a reference to their own object on arbitrary posts, users, or terms they cannot otherwise edit.
Overview
- State
- PUBLISHED
- Assigner (CNA)
- WPScan
- CVSS severity
- —
- CVSS score
- —
- CVSS vector
- —
- Effective score
- no score available from CNA, NVD, or AI yet
- CWE(s)
-
CWE-639 Authorization Bypass Through User-Controlled Key - Reserved
- 2026-09-24
- Published
- 2026-11-07 06:00 UTC
- Last updated
- 2026-11-07 18:16 UTC
- Source
- https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/97xxx/CVE-2026-97190.json
AI-forensic CVSS estimate
Used only when a CVE has no official CVSS from its CNA or NVD. An LLM estimates the v3.1 base score from the description; a HIGH/CRITICAL estimate promotes the CVE to a Threat.
No AI estimate yet — it runs automatically once NVD has been checked, or click the button above.
European Union Vulnerability Database ENISA EUVD
ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.
- EUVD ID
-
EUVD-2026-118956
EUVD enrichment is queued; refresh the page in a few seconds.
Affected products (1)
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| Unknown | Advanced Custom Fields (ACF®) |
6.2.0 (affected)
|
— |
Vendor references (1)
References embedded in the original CVE record by the assigning CNA.
- https://wpscan.com/vulnerability/9e35af14-3981-4751-a08a-98431c1ac9cf/ exploitvdb-entrytechnical-description
Web references (0)
DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.
No web references attached yet.
Remediations (10)
-
web:access.redhat.com
Keep this setting in place until the updates are applied. For CVE - 2026 -115560 alone, upstream expects a fix in the next routine PHP release. Remove the Controllable Memory Limit Addresses CVE - 2026 -109618. Not required on Red Hat Enterprise Linux 7, which is not affected by this flaw. Warning: This removes PHP's own memory ceiling.
2026-11-08 11:09 UTC -
web:arcticwolf.com
Arctic Wolf Labs: Finding, Prioritizing, and Patching PHP2Shell Exposure Learn about PHP2Shell ( CVE - 2026 -109618 and CVE - 2026 -109619), two critical PHP vulnerabilities that could allow unauthenticated remote code execution on web servers. Review affected versions, mitigation guidance, and detection recommendations.
2026-11-08 11:09 UTC -
web:blog.qualys.com
The mitigation script for CVE - 2026 -109618 and CVE - 2026 -109619 is now available in through the Custom Assessment and Remediation (CAR) library in TruRisk Eliminate, and you can run it directly on scanner-based hosts.
2026-11-08 11:09 UTC -
web:techcommunity.microsoft.com
Learn more: Azure WAF custom rules for PHP2Shell mitigation . Request-side signals alone may not be sufficient to reliably identify certain exploitation attempts. Signals in the server response can provide additional evidence that malicious activity has occurred, enabling more targeted mitigation with higher confidence and lower false positives.
2026-11-08 11:09 UTC -
web:ubuntu.com
Fixes for the php2shell critical severity security vulnerability are available for all supported Ubuntu releases.
2026-11-08 11:09 UTC -
web:www.armis.com
Critical PHP vulnerabilities ( CVE - 2026 -109618 & 109619) pose urgent RCE risks (CVSS 9.2). Discover key mitigation , inventory, and patch strategies to secure your servers now.
2026-11-08 11:09 UTC -
web:www.cisa.gov
CISA has updated this Alert to: (1) provide a SIGMA detection rule to help identify potentially suspicious activity; (2) incorporate partner resources; and (3) reinforce existing mitigation guidance. Purpose CISA strongly urges organizations to immediately patch the recently disclosed critical vulnerabilities in PHP, CVE - 2026 -109618
2026-11-08 11:09 UTC -
web:www.digitalocean.com
Two critical PHP remote code execution vulnerabilities ( CVE - 2026 -109618, CVE - 2026 -109619) were disclosed Oct 21, 2026 . See what's affected and how to patch .
2026-11-08 11:09 UTC -
web:www.paloaltonetworks.com
You can't protect what you can't see. Additionally, services like Unit 42 Continuous Frontier AI Defense put defender-grade AI models in the hands of defenders to find and fix vulnerabilities before attackers can weaponize them. (2) Prioritize Remediation Based on Reachability You have to reduce what is reachable by attackers.
2026-11-08 11:09 UTC -
web:www.wiz.io
Understand the critical aspects of CVE - 2026 -109619 with a detailed vulnerability assessment, exploitation potential, affected technologies, and remediation guidance.
2026-11-08 11:09 UTC
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.
Raw JSON
The full cvelistV5 record. Download as CVE-2026-97190.json.
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 2.7,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-97190",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-07T18:06:03.660951Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639 Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-07T18:16:17.273Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Advanced Custom Fields (ACF\u00ae)",
"vendor": "Unknown",
"versions": [
{
"lessThan": "6.8.11",
"status": "affected",
"version": "6.2.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "vuxvinh"
},
{
"lang": "en",
"type": "coordinator",
"value": "WPScan"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Advanced Custom Fields (ACF\u00ae) WordPress plugin before 6.8.11 does not verify that a user is allowed to edit the target object before writing to it during bidirectional relationship synchronization, allowing users with contributor-level access and above to add or remove a reference to their own object on arbitrary posts, users, or terms they cannot otherwise edit."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-639 Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-07T06:00:24.290Z",
"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"shortName": "WPScan"
},
"references": [
{
"tags": [
"exploit",
"vdb-entry",
"technical-description"
],
"url": "https://wpscan.com/vulnerability/9e35af14-3981-4751-a08a-98431c1ac9cf/"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Advanced Custom Fields 6.2.0 - 6.8.10 - Contributor+ Relationship Field Update on Arbitrary Objects via IDOR",
"x_generator": {
"engine": "WPScan CVE Generator"
}
}
},
"cveMetadata": {
"assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"assignerShortName": "WPScan",
"cveId": "CVE-2026-97190",
"datePublished": "2026-11-07T06:00:24.290Z",
"dateReserved": "2026-09-24T08:42:29.891Z",
"dateUpdated": "2026-11-07T18:16:17.273Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}