Advanced Custom Fields (ACF®)

Changelog

6.8.11

Releasedatum 2 november 2026

• Security – Custom values submitted to Checkbox, Radio, and Select fields with “Save Custom Values” enabled can no longer corrupt the field’s settings or add HTML attributes to the field’s wrapper. The new acf/fields/allow_append_choices filter can be used to restrict who can add new choices to a field. Thanks to Jakub Herman via WPScan for the responsible disclosure
• Security – ACF now sanitizes field, field group, post type, taxonomy, and options page settings saved by users without the unfiltered_html capability. For those users, a field’s wrapper settings are limited to width, class, and id. Event handler (on*) attributes in a field’s wrapper setting are no longer output for any field, including fields registered in PHP or local JSON
• Security – Field values of password-protected posts are no longer shown by the [acf] shortcode, block bindings, JSON-LD output, or the REST API until the password is entered. REST responses also no longer expand a referenced password-protected post into a full post object
• Security – The [acf] shortcode and ACF block bindings now output only user IDs for User fields, rather than personal data such as names and email addresses. The previous output can be restored with the new acf/bindings/allow_user_data filter
• Security – Files uploaded through the basic uploader by users without the upload_files capability no longer generate PDF preview images or save embedded audio and video cover art. This can be changed with the new acf/upload/generate_previews filter
• Security – ACF now discards submitted field values unless the field was rendered for the content being saved or its field group’s location rules match it.
  Inputs outside these rules, such as fields added with JavaScript, can be allowed with the acf/form/{context}/allowed_field_keys and acf/options_page/allowed_field_keys filters. Registration forms no longer save fields from field groups set to “User Form is Add / Edit”. Thanks to vuxvinh via WPScan for the responsible disclosure
• Security – WordPress’s Custom Fields meta box, its AJAX handler, and XML-RPC can no longer change meta that belongs to ACF fields
• Security – Basic uploader nonces are now tied to the content being edited
• Security – The AJAX request that loads field groups while editing a post no longer returns field groups assigned to other content
• Security – The Relationship, Post Object, and Page Link fields no longer reveal the titles or statuses of posts the current user cannot read, and no longer save newly selected posts the user cannot read. Existing selections the user cannot read are shown as “(Restricted item)” and are kept when the user saves. Thanks to vuxvinh via WPScan for the responsible disclosure
• Security – Relationship, Post Object, and Page Link values rendered in ACF Blocks now leave out posts the author of the post cannot read, such as another user’s unpublished drafts. This can be disabled with the new acf/fields/relational/hide_unreadable_posts filter
• Security – Bidirectional fields now only add references to posts the current user can edit, terms they can assign, and users they can edit or set as a post’s author. Saves made with update_field(), WP-CLI, or cron are not checked, and the new acf/bidirectional/can_update_target and acf/is_trusted_save_context filters can adjust this. Thanks to vuxvinh via WPScan for the responsible disclosure
• Fix – The [acf] shortcode and ACF block bindings no longer cause a fatal error on PHP 8 when a field returns objects, such as a Relationship field set to return post objects. These values, and arrays containing nested values such as an Image field set to return an array, now output nothing, except for User fields, which output user IDs
• Fix – Field settings containing &, <, or certain HTML entities no longer cause the field to revert to its default settings after saving
• Fix – Saving a custom choice no longer removes backslashes from the field’s other settings

6.8.10

Releasedatum 10 september 2026

• Security – ACF now validates that uploaded PDF files begin with the standard %PDF- header before further processing, rejecting files that do not match the expected format
• Security – The Relationship, Post Object, Image, Gallery, and File fields now enforce WordPress read permissions on referenced posts and attachments when returned in REST API responses
• Security – ACF now verifies both preview context and the caller’s edit capability before substituting revision data when field values are retrieved for a post
• Security – The _acf_form token used by frontend forms now expires and is bound to its issuing render, and acf_encrypt() / acf_decrypt() gain an optional $context argument for domain separation between token uses
• Security – ACF now consistently runs field validation on frontend form submissions containing field data, ensuring required-field checks and custom acf/validate_value filters cannot be circumvented
• Security – ACF’s REST API schema no longer discloses per-object field-group configuration in OPTIONS requests to callers who lack read permission on the target object
• Security – The User field AJAX endpoint now validates that the request nonce was created for a User field

6.8.9

Releasedatum – 27 augustus 2026

• Bekijk releasebericht
• Enhancement – ACF Blocks registered via acf_register_block_type() or block.json without an explicit version now default to v3 on WordPress 7.1 or later. Blocks that specify a version continue to use the version they declare, and the default can be customized via the acf/blocks/default_block_version filter
• Enhancement – ACF Blocks v3 now supports a renderPreview option in block.json. Setting "renderPreview": false shows a placeholder with the block’s icon, title, and an “Edit Block” button in the editor instead of rendering the block’s template as a live preview. The block continues to render normally on the front-end, and legacy v2 blocks combining "mode": "edit" with "supports": { "mode": false } are automatically migrated when upgraded to v3
• Fix – Inline editable fields in ACF Blocks V3 no longer require a second click before they can be edited
• Fix – Radio buttons now appear correctly in ACF admin screens
• Fix – Image and Gallery fields no longer reject SVG uploads when the Safe SVG plugin is active

6.8.8

Releasedatum – 19 augustus 2026

• Fix – Image and Gallery fields no longer reject SVG files

6.8.7

Verschijningsdatum 4 augustus 2026

• Security – ACF Image and Gallery fields now enforce server-side validation to accept only image files
• Security – The path attribute of registered ACF Blocks is now protected from being overridden by client-supplied block data
• Security – ACF’s acf_encrypt() and acf_decrypt() helpers now authenticate encrypted values with an HMAC and no longer fall back to base64 encoding when OpenSSL is unavailable
• Security – ACF’s comment, user, and options page form save handlers now only save values for fields whose field groups are assigned to the current save context
• Security – The Post Object, Page Link, and Relationship field AJAX search queries now enforce WordPress read permissions, preventing unauthenticated visitors from seeing non-public post statuses or post types
• Security – The User field now returns only user IDs in REST API responses to requesters without the list_users capability, preventing unauthenticated visitors from seeing user email addresses

6.8.6

Releasedatum – 14 juli 2026

• Fix – Google Maps field values are no longer double-encoded when saved in an ACF block
• Fix – Inserting a Link field value in the Classic Editor no longer triggers validation for other required fields before the post is saved
• Fix – Auto Inline Editing blocks no longer return truthy placeholder strings for empty field values fetched from a different post inside the block render template
• Fix – ACF Blocks (V2 and V3) no longer crash when rendering an oEmbed field whose title begins with [ or {
• Fix – Field group location rules without a location value no longer cause PHP warnings on page load
• Fix – The appearance of the URL, Number, and Select fields has been improved on WordPress 7.0+
• Fix – ACF fields now save on WooCommerce orders when using HPOS in compatibility mode

6.8.5

Release Date 30th June 2026

• Security – ACF PRO’s save handler for WooCommerce order fields now verifies security nonces and only attaches on the order edit screen, preventing unauthenticated field value updates for stores utilizing HPOS
• Security – The Flexible Content “Rename Layout” modal no longer allows for the execution of a potential stored XSS vulnerability
• Security – A default limit of 1000 has been applied to user-contributed choices for Checkbox, Radio, and Select fields to improve security, with a new acf/fields/max_appended_choices filter available for customization
• Security – Special characters within LIKE patterns are now fully escaped in wp_options queries via $wpdb->esc_like()

6.8.4

Releasedatum 10 juni 2026

• Security – ACF AJAX field handlers now validate that the request nonce was created for the expected field type
• Enhancement – ACF PRO now satisfies plugin dependencies declared against advanced-custom-fields, so plugins requiring ACF can activate when only ACF PRO is installed
• Enhancement – acf_inline_toolbar_editing_attrs() now accepts a return_array argument that returns the attributes as an escaped array suitable for use with wp_get_attachment_image()
• Fix – acf_form() with 'post_id' => 'new_post' and a fields list of field names no longer fatal errors when acf_form_head() runs before WordPress’s main query is built
• Fix – Multiple acf_form() calls wrapped inside a single outer <form> tag with one submit button no longer silently drop field values, post_title, or post_content from the non-last forms
• Fix – Duplicating a V3 block with identical attributes no longer displays corrupted preview content in the duplicate
• Fix – Switching between tabs containing WYSIWYG fields no longer leaves the admin menu pinned against a shorter page, which could lock page scroll

6.8.3

Releasedatum – 2 juni 2026

• Security – The oEmbed field’s AJAX preview no longer performs URL discovery for users without the edit_posts capability.

6.8.2

Verschijningsdatum 26 mei 2026

• Security – ACF frontend forms (acf_form()) now respect the post_title and post_content form configuration options when processing submissions, ensuring those values are only saved when the form is configured to accept them. Thanks to Sarawut Poolkhet (MisterHelloz) for the responsible disclosure.
• Security – ACF frontend forms (acf_form()) now only save values for fields assigned to the form via the fields or field_groups parameters, or via the form’s location rules

6.8.1

Releasedatum – 13 mei 2026

• Security – ACF now correctly checks user permissions before running database upgrades on a specific site in a multisite network
• New – A wp.data store (acf/fields) is now available in ACF PRO for reading and writing ACF field values from JavaScript, which can be enabled via a new acf/settings/enable_datastore filter (requires WordPress 6.7 or later).
• New – ACF PRO block bindings now support live preview and editing in the block editor, when both the datastore and the enable_block_bindings setting are enabled.
• New – ACF PRO can now save metabox field values via Gutenberg’s native REST flow with full revision and autosave support when using the datastore.
• New – ACF PRO Blocks can now define their field group inline via an acf.fields array in block.json, or via a fields argument in acf_register_block_type(), with field keys auto-generated and scoped to the block
• Fix – Repeater and Flexible Content row helpers no longer trigger a PHP 8.x TypeError when row_index_offset or the active loop index is non-numeric
• Fix – V3 Blocks with hideFieldsInSidebar enabled no longer show fields in the sidebar after the inline toolbar popover is closed
• Fix – Scrollbars no longer appear under the tabs in field groups containing many tabs
• Fix – The acf/delete-{taxonomy} ability no longer returns a 501 error when called without an explicit force argument, as terms cannot be trashed
• Fix – The prepare_field_for_ability_import filter is now correctly removed after each Abilities field group import, preventing subsequent imports in the same request from having values corrupted

6.8.0.1

Release Date 31st March 2026
PRO Only Release

• Fix – V3 blocks with WYSIWYG fields no longer enqueue TinyMCE editor assets on the frontend
• Fix – V3 blocks with identical attributes and different InnerBlocks content no longer return cached output from the first block on the frontend

6.8.0

Releasedatum – 30 maart 2026

• View Release Post
• New – ACF now integrates with the WordPress Abilities API, allowing external consumers (AI tools) to manage field groups, post types, and taxonomies when explicitly enabled via the enable_acf_ai feature flag
• New – ACF can now generate JSON-LD structured data fields when explicitly enabled via the enable_schema feature flag
• New – ACF now includes WP-CLI support with new wp acf json commands for importing, exporting, syncing, and checking the status of ACF JSON files
• New – ACF custom post Types now support the WordPress 6.9+ “Notes” editor feature via a new “Notes” checkbox in the Supports settings
• Enhancement – The Blocks V3 “Open in Expanded Editor” button text can now be customized via a new acf.expandedEditorButtonText block.json property
• Enhancement – A new acf/blocks/default_expanded_editor_button_text PHP filter allows customizing the default “Open in Expanded Editor” button text for all V3 blocks
• Enhancement – The Blocks V3 edit and “Open in Expanded Editor” buttons can now be hidden via a new acf.expandedEditorButtons block.json property
• Enhancement – A new blocks/expanded_editor_overlay_class JS filter allows customizing the CSS class on the Expanded Editor modal overlay
• Enhancement – ACF Blocks V3 now preloads the block form HTML alongside the preview, eliminating an extra AJAX call on mount
• Enhancement – ACF inline script tags now use wp_print_inline_script_tag() for Content Security Policy (CSP) compliance and nonce support
• Enhancement – The Expanded Editor buttons are now hidden for V3 blocks that have no fields assigned
• Fix – Flexible Content fields now properly clean up nested postmeta when a parent layout containing nested Flexible Content fields is deleted
• Fix – The Expanded Editor “Done” button now stays disabled until the AJAX save completes, preventing data loss
• Fix – Pressing Escape while the Expanded Editor is saving will no longer close the modal, preventing data loss
• Fix – InnerBlocks content containing backslashes or dollar signs now renders correctly
• Fix – Auto Inline Editing now only applies to ACF Blocks V3, resolving incorrect hover/focus borders appearing on V2 blocks
• Fix – Validation errors in the V3 Expanded Editor no longer cause a dead-end state
• Fix – Icon Picker selections in Repeater fields no longer disappear
• Fix – Range field number input now syncs to the slider and correctly updates V3 block previews
• Fix – Message field Name and Instructions settings are no longer shown in the field group editor
• Fix – Image field no longer crashes in WordPress 7.0 release candidates
• Fix – Auto Inline Editing blocks now receive block context variables in render templates
• Fix – V3 blocks registered via PHP now correctly show the “Open in Expanded Editor” button
• Fix – Flexible Content disabled layouts now work correctly in Blocks V3
• Fix – Auto Inline Editing now works with blocks using renderCallback
• i18n – Added Danish translation

6.7.2

Releasedatum – 26 maart 2026

• Security – Users’ unfiltered_html capability is now correctly applied to REST API calls
• Security – Block Preview rendering now correctly checks the user has permission to edit that post
• Security – Repeater fields using pagination now correctly checks the user has permissions to edit that post
• Security – Flexible content fields layout title AJAX requests now correctly verify security nonces
• Security – Clone field AJAX admin endpoints now correctly check ACF admin permissions for field group listings

6.7.1

Releasedatum 3 maart 2026

• Security – User field AJAX queries now enforce field-configured role restrictions and validate search permissions
• Security – Post Object, Relationship, and Page Link field AJAX queries now enforce field-configured restrictions for post status, post type, and taxonomy

6.7.0.2

Release Date 11th December 2025
PRO Only Release

• Fix – Posts with V3 blocks can now be saved without clicking the block

6.7.0.1

Release Date 10th December 2025
PRO Only Release

• Fix – Fields in V3 Blocks used as an InnerBlock are now clickable
• Fix – V3 Blocks with a script tag in the render template no longer crash in the editor
• Fix – V3 Blocks with Inline Editing enabled no longer crash the browser tab in some scenarios
• Fix – V3 Blocks with Inline Editing enabled used as an InnerBlock no longer update the field values of the parent block
• Fix – Quickly closing the expanded editor for V3 blocks will no longer prevent field values from being updated

6.7.0

Releasedatum – 3 december 2025

• View Release Post
• New – ACF Blocks V3 now supports Inline Editing – edit your block content directly in place, right inside the editor. Just opt in to enable it.
• Enhancement – Accordion field accessibility improvements
• Enhancement – Google Maps field accessibility improvements
• Enhancement – Styling improvements to the V3 Blocks expanded editor
• Fix – V3 ACF Blocks validation now clears properly when more than one block is in the editor.
• Fix – Relationship, Post Object, and Page Link fields now sort posts correctly on WordPress 6.8+
• Fix – List tables now respect the convert_field_name_to_lowercase javascript filter
• Fix – WYSIWYG field on attachment pages no longer sends ajax on every keystroke

6.6.2

Releasedatum – 29 oktober 2025

• Enhancement – Added a new convert_field_name_to_lowercase JS filter to allow uppercase letters in ACF field names
• Enhancement – The form for V3 Blocks can now be optionally hidden from the sidebar via a new hideFieldsInSidebar setting in block.json
• Enhancement – V3 Blocks now display an “Open Expanded Editor” button in the sidebar for easier access to the full edit form
• Fix – The buttons to reorder ACF metaboxes are no longer hidden for metaboxes in the block editor sidebar
• Fix – V3 Blocks now display a fallback message when the block preview can’t be rendered due to invalid HTML being used in field values
• Fix – V3 Blocks no longer show a loading spinner when preloaded
• Fix – V3 Blocks now save default field values even if the block wasn’t interacted with before saving
• Fix – Pressing CMD/CTRL + Z no longer causes the fields to disappear in V3 Blocks
• Fix – The form for V3 Blocks now opens on the left side in RTL languages

6.6.1

Release datum 16 oktober 2025

• Fix – The Color Picker palette now displays correctly with a larger number of custom palette colors
• Fix – The WYSIWYG field no longer displays an extra textarea in ACF Blocks
• Fix – The type signature of the ACF Blocks render function now matches prior to 6.6, resolving potential type hinting errors
• Fix – V3 Blocks now correctly update the block preview when changing text controls
• Fix – V3 Blocks now work correctly in the Widget block editor
• Fix – V3 Blocks no longer render an extra hidden div into the block editor
• Fix – Fields on V3 blocks now consistently render properly when switching between “Post” and “Block” view in the sidebar

6.6.0

Releasedatum – 7 oktober 2025

• View Release Post
• New – ACF Blocks Version 3 supports WordPress Block API Version 3
• New – ACF now requires WordPress version 6.2 or newer
• Enhancement – Field Groups can now have a separate Display Title
• Enhancement – Accessibility improvements for button groups, checkbox, radio, and image field types
• Enhancement – Color Picker field can now use a custom palette or use theme.json colors as the palette
• Enhancement – ACF admin notices now use WordPress core styles again
• Enhancement – The Flexible Content “Delete Layout” and “Rename Layout” modals now display correctly on mobile
• Fix – Blocks V3: You can now edit ACF blocks in Edit mode inside WP Core’s pattern editor
• Fix – Blocks V3: Validation errors now first appear after you click “Save/publish”, as opposed to immediately, while you are typing into a field for the first time
• Fix – Blocks V3: After fixing a field validation error it shows as fixed immediately as opposed to needing to click out of the block and back into it
• Fix – Blocks V3: Blocks with radio buttons no longer affect each other’s field values
• Fix – Blocks V3: Blocks with required radio buttons now validate correctly
• Fix – Blocks V3: ACF field validation now works in the Site Editor
• Fix – Blocks V3: WYSIWYG fields are no longer affected by typing into other blocks
• Fix – New field names are lowercase only
• Fix – Icon Picker now enforces required validation
• Fix – Calls to jQuery’s deprecated focus function have been updated to use the trigger function
• Fix – Layouts inside cloned Flexible Content fields can now be disabled and renamed
• i18n – Updated PRO Japanese translations (props danielkun)

6.5.1

Releasedatum 10 september 2025

• Enhancement – The Flexible Content “Expand All” and “Collapse All” button now appear correctly on mobile
• Enhancement – The Flexible Content delete layout button is now back in the main layout header, making it easier to delete layouts
• Enhancement – The JSON import tool now limits the selectable files to JSON files
• Fix – Disabled Flexible Content layouts are no longer counted towards min/max layout validation
• Fix – The top “Add Row” button for layouts is now disabled when layouts have reached the max layouts validation
• Fix – The per-layout “Add Row” and “Duplicate Layout” buttons are now disabled when layouts have reached the max layouts validation
• Fix – Disabling Flexible Content layouts no longer disables layouts in cloned Flexible Content fields using a different post ID on the same page
• Fix – Flexible Content “Add Layout” menu is no longer hidden by some field types
• Fix – Flexible Content layout names can now allow some safe HTML
• Fix – When creating a temporary post type during import, ACF now correctly sets the ACF post type, rather than defaulting to post
• Fix – ACF PRO updates are now shown even when no other plugins have an update available

6.5.0.1

Release Date 12th August 2025
PRO Only Release

• Fix – Flexible Content layouts configured with a “Layout” setting of “Table” are now rendered correctly in the post editor
• Fix – Flexible Content “Add Layout” buttons now insert the new layout in the correct position
• Fix – Long Flexible Content layout names no longer extend outside of the “Add Layout” dropdown

6.5.0

Releasedatum – 11 augustus 2025

• New – Flexible Content layouts can now be renamed in the post editor, giving content editors better clarity when managing layouts
• New – Flexible Content layouts can now be disabled, preventing them from rendering on the frontend without needing to delete their data
• New – Flexible Content layouts can now be collapsed and expanded in bulk for faster content editing
• New – Editing a Flexible Content layout now highlights the layout being edited, making it easier to identify
• New – The Date and Date Time Picker fields can now be configured to default to the current date
• Fix – Custom Icon Picker tabs now work correctly when used inside an ACF Block
• Fix – Duplicating a Field Group no longer causes a fatal error when using Russian translations
• Fix – ACF classes no longer use dynamic class properties, improving compatibility with PHP 8.2+
• Fix – ACF PRO no longer shows an update available immediately after updating to the latest version
• Fix – Field group metabox collapse and expand buttons are no longer misaligned in the post editor
• Fix – The ACF Site Health section no longer causes a PHP warning when field group location rules are incomplete
• Security – HTML is now escaped from field validation errors and tooltips

6.4.3

Releasedatum – 22 juli 2025

• Security – Unsafe HTML in field group labels is now correctly escaped for conditionally loaded field groups, resolving a JS execution vulnerability in the classic editor
• Security – HTML is now escaped from field group labels when output in the ACF admin
• Security – Bidirectional and Conditional Logic Select2 elements no longer render HTML in field labels or post titles
• Security – The acf.escHtml function now uses the third party DOMPurify library to ensure all unsafe HTML is removed. A new esc_html_dompurify_config JS filter can be used to modify the default behaviour
• Security – Post titles are now correctly escaped whenever they are output by ACF code. Thanks to Shogo Kumamaru of LAC Co., Ltd. for the responsible disclosure
• Security – An admin notice is now displayed when version 3 of the Select2 library is used, as it has now been deprecated in favor of version 4

6.4.2

Verschijningsdatum 20 mei 2025

• New – In ACF PRO, fields can now be added to WooCommerce Subscriptions when using HPOS
• Security – Changing a field type no longer enables the “Allow Access to Value in Editor UI” setting
• Fix – Paginated Repeater fields no longer save duplicate values when saving to a WooCommerce Order with HPOS disabled
• Fix – Blocks registered via acf_register_block_type() with a parent value of null no longer fail to register

6.4.1

Verschijningsdatum 8 mei 2025

• New – Select fields can now be configured to allow creating new options when editing the field’s value (requires the “Stylized UI” and “Multiple” field settings to be enabled)
• Enhancement – The “Escaped HTML” warning notice introduced in ACF 6.2.5 is now disabled by default
• Enhancement – The Icon Picker field now supports supplying an array of icons to a custom tab via a new acf/fields/icon_picker/{tab_name}/icons filter
• Fix – ACF Blocks are now forced into preview mode when editing a synced pattern
• Fix – The free ACF plugin once again works with the Classic Widgets plugin and the legacy ACF Options Page addon
• Fix – ACF no longer causes an infinite loop in bbPress when editing replies

6.4.0.1

Verschijningsdatum 8 april 2025

• Oplossing – Het aanroepen van acf_get_reference() met een ongeldige veldnaam veroorzaakt niet langer een fatale fout

6.4.0

Releasedatum 7 april 2025

• Nieuw – in ACF PRO kunnen velden nu worden toegevoegd aan WooCommerce bestellingen bij gebruik van HPOS
• Verbetering – ACF gebruikt nu composer om sommige klassen automatisch te laden
• Oplossing – Repeater paginatie werkt nu correct binnen een groep veld
• Oplossing – WordPress voert nu verschillende vertalingen correct uit na de init action hook
• Beveiliging – Het link veld heeft niet langer een kleine lokale XSS kwetsbaarheid
• i18n – Verschillende Brits Engelse vertaal strings hebben niet langer een citeer probleem dat links verbreekt
• i18n – Nederlandse (formele) vertalingen toegevoegd (credits aan @toineenzo)

6.3.12

Releasedatum – 21 januari 2025

• Verbetering – Bij een mislukte veldvalidatie door een beveiliging nonce worden foutmeldingen nu uitgebreider weergegeven
• Oplossing – Gedupliceerde ACF blokken verliezen hun veldwaarden niet meer na de eerste keer opslaan wanneer blok preloaden is ingeschakeld
• Oplossing – ACF blokken met complexe veldtypen functioneren nu correct wanneer React StrictMode is ingeschakeld

6.3.11

Release datum 12 november 2024

• Verbetering – Veldgroep sleutels kunnen nu met een klik worden gekopieerd
• Oplossing – Herhalende tabellen met velden die verborgen zijn door voorwaardelijke logica worden nu correct weergegeven
• Oplossing – ACF blokken functioneren nu correct in React StrictMode
• Fix – Edit mode is no longer available to ACF Blocks with an WordPress Block API version of 3 as field editing is not supported in the iframe

6.3.10.2

Releasedatum 29 oktober 2024
Alleen gratis release

• Oplossing – ACF gratis veroorzaakt niet langer een fatale fout wanneer er niet-ondersteunde verouderde ACF addons actief zijn.

6.3.10.1

Releasedatum 29 oktober 2024
Alleen gratis release

• Oplossing – ACF gratis veroorzaakt niet langer een fatale fout wanneer WPML actief is

6.3.10

Release datum 29 oktober 2024

• Beveiliging – Het instellen van een metabox callback voor extra berichttypen en taxonomieën vereist nu beheerder te zijn, of superbeheerder voor multisite-installaties
• Beveiliging – Veldspecifieke ACF nonces zijn nu voorzien van een voorvoegsel, waarmee een probleem is opgelost waarbij nonces van derden als geldig konden worden beschouwd voor AJAX aanroepen
• Enhancement – A new “Close and Add Field” option is now available when editing a field group, inserting a new field inline after the field being edited
• Verbetering – ACF en ACF PRO gebruiken nu dezelfde plugin updater voor verbeterde betrouwbaarheid en prestaties
• Oplossing – Het exporteren van berichttypen en taxonomieën met metabox callbacks exporteert nu correct de callback die door de gebruiker is gedefinieerd

6.3.9

Releasedatum – 15 oktober 2024

• Beveiliging – het bewerken van een ACF veld in de veldgroep editor kan niet langer een opgeslagen XSS kwetsbaarheid uitvoeren. Bedankt aan Duc Luong Tran (janlele91) van Viettel Cyber Security voor de verantwoordelijke melding
• Beveiliging – berichttype en taxonomie metabox callbacks hebben geen toegang meer tot superglobale waarden, waardoor de oorspronkelijke oplossing van 6.3.8 nog verder wordt versterkt
• Oplossing – ACF velden valideren nu correct wanneer ze worden gebruikt in de blok-editor en gekoppeld aan de zijbalk

6.3.8

Releasedatum 7 oktober 2024

• Security – ACF defined …