Advanced Custom Fields (ACF®) Security & Risk Analysis

The Advanced Custom Fields (ACF) plugin exhibits a mixed security posture. While it demonstrates good practices like using prepared statements for all SQL queries and a high percentage of properly escaped output, several areas raise concerns. The static analysis reveals a significant attack surface with 22 AJAX handlers, 7 of which lack authentication checks. This is a substantial risk, as it presents potential entry points for unauthorized actions. Furthermore, the presence of `unserialize` is a critical red flag, especially when combined with the possibility of unsanitized paths in taint analysis flows, although no critical or high severity flows were explicitly found in this instance.

The vulnerability history for ACF is a significant concern. A total of 9 known CVEs, with a recent one in 2025, and a past high-severity vulnerability indicate a recurring pattern of security weaknesses. The types of past vulnerabilities, including Improper Input Validation, Exposure of Sensitive Information, Missing Authorization, Deserialization of Untrusted Data, XSS, and PHP RFI, suggest that the plugin has been susceptible to a broad range of attacks. While there are currently no unpatched vulnerabilities, the historical prevalence of medium and low-severity issues, alongside a past high-severity one, means that vigilance is paramount. The plugin's strengths lie in its robust SQL handling and output escaping, but the uncovered attack surface and historical vulnerability trends necessitate caution.