Skip to content
PluginCanary

Advanced Custom Fields (ACF®)

by WP Engine · 2,000,000+ active installs · Checked 3 Nov 2026
Healthy

Healthy: 4 vulnerabilities published in the last 24 months.

89/ 100 Canary Score
Sub-scores for Advanced Custom Fields (ACF®)
Ownership100
Maintenance100
Security80
Support100
Reputation60

How the score works

Active signals

Facts we detected, with links to the source.

  • InfoSEC-34 vulnerabilities published in the last 24 months. Review this plugin.4 Nov 2026Evidence
  • InfoMOM-2Downloads in the last 4 weeks are down more than half vs the 26-week average. Review this plugin.3 Nov 2026Evidence

Ownership timeline

Who commits to the plugin's code on wordpress.org, over time.

Committers and their active periods
elliotcondon25 Mar 2011 to 2 Jun 2021, 504 commits
deliciousbrains22 Jun 2021 to 2 Nov 2026, 114 commits
Otto427 Oct 2024 to 7 Oct 2024, 1 commits
wordpressdotorg12 Oct 2024 to 30 Oct 2024, 4 commits

4 committers recorded. No ownership changes recorded since 3 Nov 2026.

Maintenance

Last release
yesterday
Releases, 24 months
30
Tested up to
7.1 current
Requires PHP
7.4 supported 8.2+
Releases per quarter for Advanced Custom Fields (ACF®)
Q1 20244
Q2 20246
Q3 20243
Q4 20246
Q1 20251
Q2 20254
Q3 20253
Q4 20254
Q1 20263
Q2 20265
Q3 20265
Q4 20261

Last release 2 Nov 2026. Tested with WordPress 7.1 (current).

Support

100% of 9 support threads resolved in the last 2 months.

Security record

PublishedIssueCVSSAffectedFixed inDays to patch
30 May 2026Advanced Custom Fields (ACF®) <= 6.8.1 - Unauthenticated Arbitrary Post Modification via Front-End Form '_post_title' and '_post_content' Parameters5.3<= 6.8.16.8.20
27 May 2026Advanced Custom Fields (ACF®) <= 6.8.1 - Missing Authorization5.3<= 6.8.16.8.20
14 Apr 2026Advanced Custom Fields (ACF®) <= 6.7.0 - Unauthenticated Missing Authorization to Arbitrary Post/Page Disclosure via AJAX Field Query Parameters5.3<= 6.7.06.7.10
8 Aug 2025Advanced Custom Fields <= 6.4.2. - HTML Injection4.1<= 6.4.26.4.30
15 Oct 2024Advanced Custom Fields <= 6.3.8 & Secure Custom Fields <= 6.3.6.2 - Authenticated (Admin+) Stored Cross-Site Scripting4.4<= 6.3.6, 6.3.7, 6.3.86.3.960
7 Oct 2024Advanced Custom Fields <= 6.3.8 - Authenticated (Admin+) Limited Arbitrary Function Call5.1<= 6.3.6, 6.3.7, 6.3.86.3.968
4 Sep 2024Advanced Custom Fields <= 6.3.5 - Authenticated Stored Cross-Site Scripting5.5<= 6.3.56.3.60
30 May 2024Advanced Custom Fields <= 6.2.10 - Authenticated (Contributor+) Arbitrary Custom Field Access4.3<= 6.2.106.3.00
17 Jan 2024Advanced Custom Fields <= 6.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Field6.4<= 6.2.46.2.50
3 Aug 2023Advanced Custom Fields 6.1 - 6.1.7 - Authenticated (Administrator+) Stored Cross-Site Scripting4.46.1 to 6.1.76.1.81
4 May 2023Advanced Custom Fields (Free and Pro) 5.8.10 to 5.12.5 & 6.0.0 to 6.1.5 - Reflected Cross-Site Scripting via 'post_status'6.15.8.10 to 5.12.5, 6.0.0 to 6.1.55.12.61
3 Apr 2023Advanced Custom Fields <= 6.0.7 - Authenticated (Contributor+) PHP Object Injection8.8<= 5.12.4, 6.0.0 to 6.0.75.12.51
18 Oct 2022Advanced Custom Fields <= 6.0.2 - Authenticated (Contributor+) Information Disclosure4.3<= 6.0.26.0.31
14 Jul 2022Advanced Custom Fields <= 5.12.2 - File Upload4.3<= 5.12.25.12.31
30 Mar 2022Advanced Custom Fields <= 5.12 - Authenticated Information Disclosure6.5< 5.12.15.12.10
2 Dec 2021Advanced Custom Fields <= 5.10 - Missing Authorization to Information Disclosure7.5< 5.115.110
2 Dec 2021Advanced Custom Fields <= 5.10 - Missing Authorization on Option Changes4.3< 5.115.110
2 Dec 2021Advanced Custom Fields <= 5.10 - Missing Authorization to Information Disclosure6.5< 5.115.110
10 Jun 2020Advanced Custom Fields <= 5.8.11 - Cross-Site Scripting6.1< 5.8.125.8.120
15 Feb 2019Advanced Custom Fields <= 5.7.11 - PHP Object Injection5.4<= 5.7.115.7.120
7 Dec 2018Advanced Custom Fields <= 5.7.7 - Author+ Stored Cross-Site Scripting5.4< 5.7.85.7.80
3 Jan 2013Advanced Custom Fields <= 3.5.1 - Remote Code Execution via Remote File Inclusion3.8<= 3.5.13.5.20

Source: Wordfence Intelligence.

Reputation

Average rating per quarter for Advanced Custom Fields (ACF®)
Q2 20254.6
Q3 20253.0
Q4 20253.0
Q1 20264.3
Q2 20264.6
Q3 20263.7

Average rating fell from 4.6 to 3.7 between Q2 2025 and Q3 2026.

Rating distribution
5 star1212
4 star33
3 star18
2 star12
1 star165
Latest low reviews

Momentum

2,000,000+ active installs. History builds with each weekly snapshot.

Weekly downloads, last 27 weeks
Weekly downloads for Advanced Custom Fields (ACF®)
4 May 202642,422
11 May 2026545,152
18 May 2026165,022
25 May 2026596,525
1 Jun 2026605,931
8 Jun 2026571,877
15 Jun 2026174,689
22 Jun 2026117,271
29 Jun 2026570,463
6 Jul 2026136,595
13 Jul 2026562,635
20 Jul 2026171,360
27 Jul 2026124,470
3 Aug 2026592,302
10 Aug 2026127,577
17 Aug 2026577,374
24 Aug 2026604,142
31 Aug 2026186,408
7 Sep 2026568,354
14 Sep 2026172,869
21 Sep 2026127,746
28 Sep 2026111,423
5 Oct 202699,492
12 Oct 202692,573
19 Oct 2026136,976
26 Oct 2026105,683
2 Nov 202624,130

Weekly downloads over the last 4 weeks are 69% below the 27-week average.

Healthier alternatives

Same category, higher Canary Score. Never sponsored.

ACF Content Analysis for Yoast SEOScore 91 · 100,000+Image Aspect Ratio Crop Field for Advanced Custom FieldsScore 91 · 20,000+Custom Post Types and Custom Fields creator - WCKScore 91 · 10,000+Genesis Custom BlocksScore 91 · 10,000+WPGraphQL for ACFScore 91 · 10,000+

Facts

Version6.8.11
AuthorWP Engine
Added25 Mar 2011
Last updated2 Nov 2026
Active installs2,000,000+
Requires WordPress6.2
Tested up to7.1.4
Requires PHP7.4
CategoryContent Management > Blog & Article Publishing
Tagsacf, meta, fields, repeater, custom fields

Other plugins by this author: Better Search Replace, WP Migrate Lite - Migration Made Easy, PHP Compatibility Checker, Database Backup for WordPress, WP Offload Media Lite for Amazon S3, DigitalOcean Spaces, and Google Cloud Storage, WP Offload SES Lite, Amazon Web Services, SQL Buddy - Database Management Made Easy, Faust.js, Gutenberg Blocks - ACF Blocks Suite, WP Engine GeoTarget, Image Processing Queue

Questions

Is Advanced Custom Fields (ACF®) still maintained?

Advanced Custom Fields (ACF®) was last updated on 2 Nov 2026. Its Canary status is Healthy.

Is Advanced Custom Fields (ACF®) safe?

Advanced Custom Fields (ACF®) has no open unpatched vulnerabilities on record. 4 vulnerabilities were published in the last 24 months. Its Canary status is Healthy.

Who owns Advanced Custom Fields (ACF®)?

The wordpress.org author is WP Engine. Recent committers: deliciousbrains, wordpressdotorg, Otto42, elliotcondon, plugin-master. We have recorded no ownership change.

What can I use instead of Advanced Custom Fields (ACF®)?

Plugins in the same category with a higher Canary Score: ACF Content Analysis for Yoast SEO, Image Aspect Ratio Crop Field for Advanced Custom Fields, Custom Post Types and Custom Fields creator - WCK, Genesis Custom Blocks, WPGraphQL for ACF.

Data: wordpress.org Plugins API, plugins SVN and Trac, wordpress.org reviews, Wordfence Intelligence.Plugin data refreshed 3 Nov 2026.Report a data issue