--- title: ACF 6.8.11 Security Release | daily.dev description: Advanced Custom Fields 6.8.11 ships multiple security fixes for ACF and ACF PRO, and all users should upgrade as soon as possible. Fields now only save when... canonical: https://daily.dev/posts/acf-6-8-11-security-release-t2cew6snc twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: ACF 6.8.11 Security Release | daily.dev og:description: Advanced Custom Fields 6.8.11 ships multiple security fixes for ACF and ACF PRO, and all users should upgrade as soon as possible. Fields now only save when... og:url: https://daily.dev/posts/acf-6-8-11-security-release-t2cew6snc og:image: https://api.daily.dev/og/posts/T2Cew6sNc.png og:image:alt: ACF 6.8.11 Security Release og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # ACF 6.8.11 Security Release **[ACF](https://daily.dev/sources/acf)** · 11 min read · 0 upvotes · 0 comments ## Summary Advanced Custom Fields 6.8.11 ships multiple security fixes for ACF and ACF PRO, and all users should upgrade as soon as possible. Fields now only save when they were shown on a form or their field group's location rules match the content being saved. The ACF shortcode and block bindings now output only a user ID instead of full personal data like name and email. Relationship, Post Object, and Page Link fields now respect read permissions, and password-protected posts keep their field values hidden until the password is entered. Bidirectional fields now check edit permissions before adding the reference on the other side. Thanks to Jakub Herman and vuxvinh via WPScan for the responsible disclosure. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Why did my ACF registration form stop saving custom fields after updating to 6.8.11? ACF 6.8.11 changed field saving so fields only save when shown on the submitted form or when their field group's location rules match the content. Registration forms using a field group with the location rule 'User Form is Add / Edit' no longer save those fields; the fix is changing the rule to 'User Form is Register' or 'All'. _Developers maintaining WordPress registration forms can track ACF breaking changes like this via daily.dev._ ### Why does the ACF user field shortcode only show a user ID instead of the name and email now? ACF 6.8.11 changed the shortcode and block bindings to output only the user ID for User fields instead of personal data such as name and email, as a security fix. To restore formatted text, use the acf/format_value filter, or use the acf/bindings/allow_user_data filter to fully restore the old output, which exposes email addresses to every visitor. _Developers patching WordPress sites after a breaking security update can follow fixes like this on daily.dev._ ### Does ACF Relationship field now hide draft posts from other users? Yes, as of ACF 6.8.11, Relationship, Post Object, and Page Link fields only show posts the current user can read. Contributors and Authors no longer see or select other users' draft, pending, or scheduled posts in searches; Editors and Administrators are unaffected, and already-selected unreadable posts display as '(Restricted item)'. _Teams auditing WordPress content permissions can keep up with fixes like this on daily.dev._ ## Similar posts on daily.dev - [ACF 6.8.4](https://daily.dev/posts/acf-6-8-4-1x216pqj3) · ACF · 4 upvotes · 0 comments - [ACF 6.8.6](https://daily.dev/posts/acf-6-8-6-gn9zh0dnt) · ACF · 10 upvotes · 0 comments - [ACF 6.8.8](https://daily.dev/posts/acf-6-8-8-buyci7n4v) · ACF · 3 upvotes · 0 comments - [ACF PRO 6.7.0.1](https://daily.dev/posts/acf-pro-6-7-0-1-hqdd5uvs9) · ACF · 12 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#php](https://daily.dev/tags/php), [#wordpress](https://daily.dev/tags/wordpress) [View this post on daily.dev](https://daily.dev/posts/acf-6-8-11-security-release-t2cew6snc) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"ACF 6.8.11 Security Release","url":"https://daily.dev/posts/acf-6-8-11-security-release-t2cew6snc","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/acf-6-8-11-security-release-t2cew6snc"},"datePublished":"2026-11-02T17:55:28.874Z","dateModified":"2026-11-02T17:58:49.070Z","description":"Advanced Custom Fields 6.8.11 ships multiple security fixes for ACF and ACF PRO, and all users should upgrade as soon as possible. Fields now only save when...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/de06810084915ba76ce2bf2647b0373f?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/de06810084915ba76ce2bf2647b0373f?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"ACF","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"ACF","logo":"https://media.daily.dev/image/upload/s---s882O9i--/f_auto/v1741896667/logos/acf","url":"https://daily.dev/sources/acf"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/acf-6-8-11-security-release-t2cew6snc","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,php,wordpress","timeRequired":"PT11M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"ACF","item":"https://daily.dev/sources/acf"},{"@type":"ListItem","position":3,"name":"ACF 6.8.11 Security Release"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/acf-6-8-11-security-release-t2cew6snc#faq","mainEntity":[{"@type":"Question","name":"Why did my ACF registration form stop saving custom fields after updating to 6.8.11?","acceptedAnswer":{"@type":"Answer","text":"ACF 6.8.11 changed field saving so fields only save when shown on the submitted form or when their field group's location rules match the content. Registration forms using a field group with the location rule 'User Form is Add / Edit' no longer save those fields; the fix is changing the rule to 'User Form is Register' or 'All'. Developers maintaining WordPress registration forms can track ACF breaking changes like this via daily.dev."}},{"@type":"Question","name":"Why does the ACF user field shortcode only show a user ID instead of the name and email now?","acceptedAnswer":{"@type":"Answer","text":"ACF 6.8.11 changed the shortcode and block bindings to output only the user ID for User fields instead of personal data such as name and email, as a security fix. To restore formatted text, use the acf/format_value filter, or use the acf/bindings/allow_user_data filter to fully restore the old output, which exposes email addresses to every visitor. Developers patching WordPress sites after a breaking security update can follow fixes like this on daily.dev."}},{"@type":"Question","name":"Does ACF Relationship field now hide draft posts from other users?","acceptedAnswer":{"@type":"Answer","text":"Yes, as of ACF 6.8.11, Relationship, Post Object, and Page Link fields only show posts the current user can read. Contributors and Authors no longer see or select other users' draft, pending, or scheduled posts in searches; Editors and Administrators are unaffected, and already-selected unreadable posts display as '(Restricted item)'. Teams auditing WordPress content permissions can keep up with fixes like this on daily.dev."}}]} ```