Skip to content
PluginCanary

Advanced Custom Fields

Advanced Custom Fields: Extended
by Konrad Chmielewski · 100,000+ active installs · Checked 3 Nov 2026
Healthy

Healthy: maintained, last release 19 Oct 2026, 13 releases in 24 months, no unpatched vulnerabilities.

81/ 100 Canary Score
Sub-scores for Advanced Custom Fields
Ownership100
Maintenance100
Security60
Support70
Reputation70

How the score works

Quick answers

Is Advanced Custom Fields still maintained?
Yes. Last release 19 Oct 2026, 13 releases in the last 24 months. 19 Oct 2026 · wordpress.org
Who owns Advanced Custom Fields, and has it changed hands?
No change recorded. Main committer hwk-fr since Mar 2019. 3 Nov 2026 · SVN log
Was Advanced Custom Fields removed from wordpress.org?
No. Listed on wordpress.org as of 3 Nov 2026. 3 Nov 2026 · wordpress.org
Is Advanced Custom Fields safe?
20 known vulnerabilities, all fixed (latest in 0.9.2.8). Not on the exploited list. 30 Oct 2026 · Wordfence Intelligence
Is the latest Advanced Custom Fields update safe to install?
No ownership change before 0.9.2.8. No one-star spike after it. 19 Oct 2026 · Release history

Active signals

Facts we detected, with links to the source.

No open risk signals. Signals appear here when we detect an ownership change, closure, vulnerability or decline.

Ownership timeline

Who commits to the plugin's code on wordpress.org, over time.

Committers and their active periods
plugin-master18 Mar 2019 to 18 Mar 2019, 1 commits
hwk-fr18 Mar 2019 to 19 Oct 2026, 226 commits

2 committers recorded. No ownership change since 2019.

Maintenance

Last release
16 days ago
Releases, 24 months
13
Tested up to
7.1 current
Requires PHP
5.6 supported 8.2+
Releases per quarter
Releases per quarter for Advanced Custom Fields
Q1 20240
Q2 20247
Q3 20241
Q4 20243
Q1 20250
Q2 20250
Q3 20251
Q4 20253
Q1 20261
Q2 20263
Q3 20261
Q4 20261

Last release 19 Oct 2026. Tested with WordPress 7.1 (current).

Reputation

Last 90 days: no reviews. Lifetime: 4.8.

Average rating per quarter for Advanced Custom Fields
Q4 20235.0
Q3 20245.0
Q4 20245.0
Q1 20255.0

Average rating stayed at 5.0 between Q4 2023 and Q1 2025.

Rating distribution
5 star124
4 star2
3 star1
2 star0
1 star5
Latest low reviews

Security record

18 vulnerabilities in 24 months (20 on record), all patched (latest fixed in 0.9.2.8).

Show 20 patched vulnerabilities
PublishedIssueCVSSAffectedFixed inDays to patch
30 Oct 2026Advanced Custom Fields: Extended <= 0.9.2.7 - Unauthenticated Sensitive Information Exposure in 'acf[<mapped_field>]' Parameter via {get_user} Template Tag Injection7.5<= 0.9.2.70.9.2.8Patched before disclosure
27 Oct 2026Advanced Custom Fields: Extended <= 0.9.2.7 - Missing Authorization to Unauthenticated Data Exposure via Multiple AJAX Endpoints5.3<= 0.9.2.70.9.2.8Patched before disclosure
26 Oct 2026Advanced Custom Fields: Extended <= 0.9.2.6 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via Email Action Dynamic File Field4.8<= 0.9.2.60.9.2.7Patched before disclosure
23 Oct 2026Advanced Custom Fields: Extended 0.9.2.7 - Unauthenticated Arbitrary Non-Admin Account Takeover7.30.9.2.70.9.2.8Patched before disclosure
23 Oct 2026Advanced Custom Fields: Extended 0.8.9.4 - 0.9.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting6.40.8.9.4 to 0.9.2.70.9.2.8Patched before disclosure
23 Oct 2026Advanced Custom Fields: Extended 0.9.2.7 - Unauthenticated Privilege Escalation via Account Takeover9.80.9.2.70.9.2.8Patched before disclosure
23 Oct 2026Advanced Custom Fields: Extended <= 0.9.2.7 - Unauthenticated Remote Code Execution9.8< 0.9.2.80.9.2.8Patched before disclosure
21 Oct 2026Advanced Custom Fields: Extended 0.9.2.4 - 0.9.2.7 - Unauthenticated Arbitrary Shortcode Execution6.50.9.2.4 to 0.9.2.70.9.2.8Patched before disclosure
20 Oct 2026Advanced Custom Fields: Extended <= 0.9.2.7 - Unauthenticated Stored Cross-Site Scripting7.2<= 0.9.2.70.9.2.8Patched before disclosure
20 Oct 2026Advanced Custom Fields: Extended <= 0.9.2.7 - Unauthenticated Arbitrary File Deletion9.1<= 0.9.2.70.9.2.8Patched before disclosure
20 Oct 2026Advanced Custom Fields: Extended <= 0.9.2.7 - Missing Authorization5.3<= 0.9.2.70.9.2.8Patched before disclosure
3 Sep 2026Advanced Custom Fields: Extended 0.9.2.2 - 0.9.2.6 - Unauthenticated Privilege Escalation7.30.9.2.2 to 0.9.2.60.9.2.7Patched before disclosure
31 Aug 2026Advanced Custom Fields: Extended < 0.9.2.7 - Unauthenticated Privilege Escalation via Administrator Account Takeover9.8< 0.9.2.70.9.2.7Patched before disclosure
27 Aug 2026Advanced Custom Fields: Extended <= 0.9.2.6 - Missing Authorization4.3<= 0.9.2.60.9.2.7Patched before disclosure
28 May 2026Advanced Custom Fields: Extended <= 0.9.2.5 - Unauthenticated Privilege Escalation via Validation Bypass to '_acf_post_id' Parameter9.8<= 0.9.2.50.9.2.6Patched before disclosure
12 May 2026Advanced Custom Fields: Extended <= 0.9.2.3 - Unauthenticated Arbitrary Shortcode Execution6.5<= 0.9.2.30.9.2.4Patched before disclosure
19 Jan 2026Advanced Custom Fields: Extended <= 0.9.2.1 - Unauthenticated Privilege Escalation via Insert User Form Action9.8<= 0.9.2.10.9.2.2Patched before disclosure
2 Dec 2025Advanced Custom Fields: Extended 0.9.0.5 - 0.9.1.1 - Unauthenticated Remote Code Execution in prepare_form9.80.9.0.5 to 0.9.1.10.9.2Patched before disclosure
29 Sep 2023Advanced Custom Fields: Extended <= 0.8.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4<= 0.8.9.30.8.9.4Patched before disclosure
24 Dec 2021Advanced Custom Fields: Extended <= 0.8.8.6 - Admin+ SQL Injection7.2<= 0.8.8.60.8.8.7Patched before disclosure

Changelog mentions of security fixes: 0.9.2.8 (security, nonce, escaping).

Sources: Wordfence Intelligence, CISA Known Exploited Vulnerabilities, readme changelogs.

Support

0% of 1 support threads resolved in the last 2 months.

Momentum

100,000+ active installs. History builds with each weekly snapshot.

Weekly downloads, last 27 weeks
Weekly downloads for Advanced Custom Fields
4 May 20263,846
11 May 20268,845
18 May 202637,724
25 May 202637,675
1 Jun 202614,530
8 Jun 20268,408
15 Jun 20266,999
22 Jun 20266,180
29 Jun 20266,051
6 Jul 20268,426
13 Jul 20265,116
20 Jul 20266,986
27 Jul 20265,769
3 Aug 20265,958
10 Aug 20265,056
17 Aug 20265,092
24 Aug 202634,156
31 Aug 202614,720
7 Sep 20269,252
14 Sep 202610,521
21 Sep 20268,962
28 Sep 20267,481
5 Oct 20266,325
12 Oct 20266,101
19 Oct 202643,979
26 Oct 202617,767
2 Nov 20262,127

Weekly downloads over the last 4 weeks are 41% above the 27-week average.

Healthier alternatives

Same job, rated Healthy, higher Canary Score and at least 10,000 installs. Never sponsored.

ACF Content Analysis for Yoast SEOScore 91 · 100,000+Image Aspect Ratio Crop Field forScore 91 · 20,000+WPGraphQL for ACFScore 91 · 10,000+Custom Post Types and Custom FieldsScore 91 · 10,000+Genesis Custom BlocksScore 91 · 10,000+

Facts

Version0.9.2.8
AuthorKonrad Chmielewski
Added18 Mar 2019
Last updated19 Oct 2026
Active installs100,000+
Requires WordPress4.9
Tested up to7.1.4
Requires PHP5.6
CategoryDeveloper Tools & Customization > API & Webhook Integration
Tagsacf, meta, admin, fields, custom fields

Other plugins by this author: WP 404 Auto Redirect to Similar Post, WP Steam Auth, WP G2A Goldmine CD Keys Affiliate, WP Front Admin

Questions

Is Advanced Custom Fields still maintained?

Yes. Last release 19 Oct 2026, 13 releases in the last 24 months.

Who owns Advanced Custom Fields, and has it changed hands?

No change recorded. Main committer hwk-fr since Mar 2019.

Was Advanced Custom Fields removed from wordpress.org?

No. Listed on wordpress.org as of 3 Nov 2026.

Is Advanced Custom Fields safe?

20 known vulnerabilities, all fixed (latest in 0.9.2.8). Not on the exploited list.

Is the latest Advanced Custom Fields update safe to install?

No ownership change before 0.9.2.8. No one-star spike after it.

Data: wordpress.org Plugins API, plugins SVN and Trac, wordpress.org reviews and support forum, Wordfence Intelligence, CISA KEV, NVD.Plugin data refreshed 3 Nov 2026.Report a data issue