{"affected":[{"defaultStatus":"unaffected","product":"Advanced Custom Fields (ACF®)","source":"CNA: WPScan","vendor":"Unknown","versions":[{"lessThan":"6.8.11","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-97189","cwes":["CWE-200"],"description":"The Advanced Custom Fields (ACF®) WordPress plugin before 6.8.11 does not perform a read-permission check when it renders and formats the values of its relational fields, allowing users with post-editing access (Contributor and above) to disclose the titles and non-public statuses of other users' unpublished posts.","epss":null,"exploits":[{"kind":"exploit","source":"CNA: WPScan","url":"https://wpscan.com/vulnerability/694a3ef1-a4b8-41fc-9630-134d549b4176/"}],"kev":null,"metrics":[],"modifiedAt":1794031224104,"publishedAt":1794031224104,"references":[{"source":"CNA: WPScan","tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/694a3ef1-a4b8-41fc-9630-134d549b4176/"}],"remediation":[],"revision":"25072568aa94721df9cc7e64dfff32dc84ebc8f9e24bb3811fdad7603994475e","sources":[{"modifiedAt":1794031224104,"name":"CNA: WPScan","retrievedAt":1794031744359,"url":"https://www.cve.org/CVERecord?id=CVE-2026-97189"}],"ssvc":null,"status":"published","title":"Advanced Custom Fields < 6.8.11 - Contributor+ Unpublished Post Title and Status Disclosure via Relational Fields","updatedAt":1794031744359}