CVE-2026-97191
📛 CVE Title
Advanced Custom Fields < 6.8.11 - Contributor+ Admin-Restricted Custom Field Update via Post Save Path
Description
The Advanced Custom Fields (ACF®) WordPress plugin before 6.8.11 does not re-apply its field-group location rules when persisting values submitted through the post editor save path, allowing users with contributor-level access and above to write custom fields the site restricted to administrators onto their own posts.
Overview
- State
- PUBLISHED
- Assigner (CNA)
- WPScan
- CVSS severity
- —
- CVSS score
- —
- CVSS vector
- —
- Effective score
- no score available from CNA, NVD, or AI yet
- CWE(s)
-
CWE-284 Improper Access Control - Reserved
- 2026-09-24
- Published
- 2026-11-07 06:00 UTC
- Last updated
- 2026-11-07 18:16 UTC
- Source
- https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/97xxx/CVE-2026-97191.json
AI-forensic CVSS estimate
Used only when a CVE has no official CVSS from its CNA or NVD. An LLM estimates the v3.1 base score from the description; a HIGH/CRITICAL estimate promotes the CVE to a Threat.
No AI estimate yet — it runs automatically once NVD has been checked, or click the button above.
European Union Vulnerability Database ENISA EUVD
ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.
- EUVD ID
-
EUVD-2026-118957
EUVD enrichment is queued; refresh the page in a few seconds.
Affected products (1)
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| Unknown | Advanced Custom Fields (ACF®) |
0 (affected)
|
— |
Vendor references (1)
References embedded in the original CVE record by the assigning CNA.
- https://wpscan.com/vulnerability/3eb847d4-6649-4f71-8dc7-e739a6317409/ exploitvdb-entrytechnical-description
Web references (0)
DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.
No web references attached yet.
Remediations (10)
-
web:arcticwolf.com
Arctic Wolf Labs: Finding, Prioritizing, and Patching PHP2Shell Exposure Learn about PHP2Shell ( CVE - 2026 -109618 and CVE - 2026 -109619), two critical PHP vulnerabilities that could allow unauthenticated remote code execution on web servers. Review affected versions, mitigation guidance, and detection recommendations.
2026-11-08 11:08 UTC -
web:ma.ttias.be
Mitigations for CVE - 2026 -109618 and CVE - 2026 -109619 that work until you can install the fixed PHP, based on PHP's advisories. Tested configs for nginx, Apache, …
2026-11-08 11:08 UTC -
web:techaeris.com
PHP2Shell, the two critical PHP remote code execution flaws leaked a day early, now has an emergency patch . Here is what shipped, what is still exposed, and what to do.
2026-11-08 11:08 UTC -
web:techcommunity.microsoft.com
Learn more: Azure WAF custom rules for PHP2Shell mitigation . Request-side signals alone may not be sufficient to reliably identify certain exploitation attempts. Signals in the server response can provide additional evidence that malicious activity has occurred, enabling more targeted mitigation with higher confidence and lower false positives.
2026-11-08 11:08 UTC -
web:ubuntu.com
Fixes for the php2shell critical severity security vulnerability are available for all supported Ubuntu releases.
2026-11-08 11:08 UTC -
web:www.8x8.com
Security update: PHP vulnerabilities CVE - 2026 -109618 and CVE - 2026 -109619 Last updated: 12:00 PM PST, 10/27/ 2026 We have mitigated or upgraded the affected PHP versions across the identified systems. Comprehensive security measures are in place, providing centralised visibility and correlation across our environment. We are continuing to monitor the situation.
2026-11-08 11:08 UTC -
web:www.digitalocean.com
Two critical PHP remote code execution vulnerabilities ( CVE - 2026 -109618, CVE - 2026 -109619) were disclosed Oct 21, 2026 . See what's affected and how to patch .
2026-11-08 11:08 UTC -
web:www.esecurityplanet.com
CISA confirms exploitation of a WordPress Core upgrade flaw. Learn which versions contain fixes and what administrators should check for signs of compromise.
2026-11-08 11:08 UTC -
web:www.thehackerwire.com
How do I fix or mitigate CVE-2026-97191 ? To protect against CVE-2026-97191 , you should: (1) Apply the latest security patches from the vendor, (2) Check official security advisories for specific remediation steps, (3) Update affected software to the latest version, and (4) Monitor your systems for any signs of exploitation.
2026-11-08 11:08 UTC -
web:www.wiz.io
Understand the critical aspects of CVE - 2026 -109619 with a detailed vulnerability assessment, exploitation potential, affected technologies, and remediation guidance.
2026-11-08 11:08 UTC
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.
Raw JSON
The full cvelistV5 record. Download as CVE-2026-97191.json.
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 2.7,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-97191",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-07T18:05:52.735369Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-07T18:16:17.125Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Advanced Custom Fields (ACF\u00ae)",
"vendor": "Unknown",
"versions": [
{
"lessThan": "6.8.11",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "vuxvinh"
},
{
"lang": "en",
"type": "coordinator",
"value": "WPScan"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Advanced Custom Fields (ACF\u00ae) WordPress plugin before 6.8.11 does not re-apply its field-group location rules when persisting values submitted through the post editor save path, allowing users with contributor-level access and above to write custom fields the site restricted to administrators onto their own posts."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-284 Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-07T06:00:24.463Z",
"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"shortName": "WPScan"
},
"references": [
{
"tags": [
"exploit",
"vdb-entry",
"technical-description"
],
"url": "https://wpscan.com/vulnerability/3eb847d4-6649-4f71-8dc7-e739a6317409/"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Advanced Custom Fields < 6.8.11 - Contributor+ Admin-Restricted Custom Field Update via Post Save Path",
"x_generator": {
"engine": "WPScan CVE Generator"
}
}
},
"cveMetadata": {
"assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"assignerShortName": "WPScan",
"cveId": "CVE-2026-97191",
"datePublished": "2026-11-07T06:00:24.463Z",
"dateReserved": "2026-09-24T08:42:31.544Z",
"dateUpdated": "2026-11-07T18:16:17.125Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}