{"id":"CVE-2026-97190","aliases":[],"cve":{"records":[{"id":"CVE-2026-97190","source":"WPScan","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-09-24T08:42:29.891Z","published":"2026-11-07T06:00:24.290Z","modified":"2026-11-07T18:16:17.273Z"}],"publishers":[{"name":"WPScan","role":"CNA","organizationId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","modified":"2026-11-07T06:00:24.290Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-07T18:16:17.273Z"}],"references":[{"url":"https://wpscan.com/vulnerability/9e35af14-3981-4751-a08a-98431c1ac9cf/","tags":["exploit","vdb-entry","technical-description"],"source":"WPScan"}],"weaknesses":[{"id":"CWE-639","description":"CWE-639 Authorization Bypass Through User-Controlled Key","source":"CISA-ADP"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-07T18:06:03.660951Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"title":"Advanced Custom Fields 6.2.0 - 6.8.10 - Contributor+ Relationship Field Update on Arbitrary Objects via IDOR","titleSource":"WPScan","descriptionSource":"WPScan","description":"The Advanced Custom Fields (ACF®) WordPress plugin before 6.8.11 does not verify that a user is allowed to edit the target object before writing to it during bidirectional relationship synchronization, allowing users with contributor-level access and above to add or remove a reference to their own object on arbitrary posts, users, or terms they cannot otherwise edit.","score":2.7,"severity":"low","published":"2026-11-07T06:00:24.290Z","modified":"2026-11-07T18:16:17.273Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Unknown","name":"Advanced Custom Fields (ACF®)","platforms":[],"versions":[{"version":"6.2.0","status":"affected","lessThan":"6.8.11","versionType":"semver"}],"defaultStatus":"unaffected","cpes":[],"source":"WPScan","url":"https://www.cve.org/CVERecord?id=CVE-2026-97190"}],"remediation":[],"references":["https://wpscan.com/vulnerability/9e35af14-3981-4751-a08a-98431c1ac9cf/"],"sources":[{"name":"CVE","id":"CVE-2026-97190","modified":"2026-11-07T18:16:17.273Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-97190"}],"assessments":[{"source":"CISA-ADP","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","score":2.7}],"sourceAffected":[],"observedAt":"2026-11-07T18:26:21.720Z","kev":{"status":"not-listed","checkedAt":"2026-11-14T22:50:32.984Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-07T06:40:38.940Z","attemptedAt":"2026-11-07T06:40:38.940Z"},{"source":"GHSA","status":"available","checkedAt":"2026-11-07T06:40:36.353Z","attemptedAt":"2026-11-07T06:40:36.353Z"},{"source":"EUVD","status":"no-result","checkedAt":"2026-11-07T06:40:37.282Z","attemptedAt":"2026-11-07T06:40:37.282Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-11-07T06:40:36.820Z","attemptedAt":"2026-11-07T06:40:36.820Z"}],"evidence":[{"source":"GitHub Advisory Database","id":"GHSA-rxjg-4wwx-r4pf","url":"https://github.com/advisories/GHSA-rxjg-4wwx-r4pf","modified":"2026-11-07T06:31:31Z","checkedAt":"2026-11-07T06:40:36.353Z"},{"source":"NVD","id":"CVE-2026-97190","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97190","modified":"2026-11-07T06:16:59.617","checkedAt":"2026-11-07T06:40:38.940Z"}],"aiSummary":{"text":"The Advanced Custom Fields WordPress plugin, versions 6.2.0 to 6.8.10, allows users with contributor-level access to update arbitrary objects via an IDOR vulnerability. This occurs because the plugin does not verify user permissions before writing to objects during relationship synchronization. Users can add or remove references to their own objects on posts, users, or terms they cannot edit.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-07T18:31:09.387Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-97190"}]}}