CVE-2026-97190

{
  "etk_id": "ETK-2026-3798",
  "cve_id": "CVE-2026-97190",
  "display_id": "CVE-2026-97190",
  "ghsa_id": "GHSA-rxjg-4wwx-r4pf",
  "euvd_id": "EUVD-2026-118956",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Authorization bypass in Advanced Custom Fields relationship synchronization",
  "summary": "Advanced Custom Fields versions before 6.8.11 can allow bidirectional relationship synchronization to change references on posts, users, or terms outside the acting user's edit permissions. Exploitation requires an authenticated WordPress account with contributor-level access or greater and access to the affected synchronization functionality.",
  "mitigation": "Upgrade Advanced Custom Fields to version 6.8.11 or later. Restrict contributor and other untrusted accounts until the update is deployed.",
  "vendor": null,
  "product": "Advanced Custom Fields (ACF®)",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 6.2.0, < 6.8.11"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "6.8.11"
      ],
      "package_name": "Advanced Custom Fields (ACF®)",
      "purl": null
    }
  ],
  "cwes": [
    639
  ],
  "cvss_score": 2.7,
  "cvss_src": "nvd",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": false,
  "pipeline_minutes": 20.36239295,
  "t0_at": "2026-11-07T06:00:24.290000+00:00",
  "signals": {
    "check": {
      "at": "2026-11-07T07:09:00.058054+00:00",
      "days": 0.047636204328703705,
      "is_lower_bound": false,
      "measured_at": "2026-11-07T06:00:24.290000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-11-07T06:00:24.290000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-07T06:00:24.290000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-97190"
    }
  }
}