Todas as versões registradas, da mais nova para a mais antiga, com o que mudou em cada uma.
Última 6.8.1115 versões
Sem data · 15 versões
6.8.11
Última
3 correções12 de segurança2 alterações
Corrigido
The [acf] shortcode and ACF block bindings no longer cause a fatal error on PHP 8 when a field returns objects, such as a Relationship field set to return post objects. These values, and arrays containing nested values such as an Image field set to return an array, now output nothing, except for User fields, which output user IDs
Field settings containing `&`, `
Saving a custom choice no longer removes backslashes from the field's other settings
Segurança
Custom values submitted to Checkbox, Radio, and Select fields with "Save Custom Values" enabled can no longer corrupt the field's settings or add HTML attributes to the field's wrapper. The new `acf/fields/allow_append_choices` filter can be used to restrict who can add new choices to a field. Thanks to Jakub Herman via WPScan for the responsible disclosure
ACF now sanitizes field, field group, post type, taxonomy, and options page settings saved by users without the `unfiltered_html` capability. For those users, a field's wrapper settings are limited to width, class, and id. Event handler (`on*`) attributes in a field's wrapper setting are no longer output for any field, including fields registered in PHP or local JSON
Field values of password-protected posts are no longer shown by the `[acf]` shortcode, block bindings, JSON-LD output, or the REST API until the password is entered. REST responses also no longer expand a referenced password-protected post into a full post object
The `[acf]` shortcode and ACF block bindings now output only user IDs for User fields, rather than personal data such as names and email addresses. The previous output can be restored with the new `acf/bindings/allow_user_data` filter
Files uploaded through the basic uploader by users without the `upload_files` capability no longer generate PDF preview images or save embedded audio and video cover art. This can be changed with the new `acf/upload/generate_previews` filter
ACF now discards submitted field values unless the field was rendered for the content being saved or its field group's location rules match it.
WordPress's Custom Fields meta box, its AJAX handler, and XML-RPC can no longer change meta that belongs to ACF fields
Basic uploader nonces are now tied to the content being edited
The AJAX request that loads field groups while editing a post no longer returns field groups assigned to other content
The Relationship, Post Object, and Page Link fields no longer reveal the titles or statuses of posts the current user cannot read, and no longer save newly selected posts the user cannot read. Existing selections the user cannot read are shown as "(Restricted item)" and are kept when the user saves. Thanks to vuxvinh via WPScan for the responsible disclosure
Relationship, Post Object, and Page Link values rendered in ACF Blocks now leave out posts the author of the post cannot read, such as another user's unpublished drafts. This can be disabled with the new acf/fields/relational/hide_unreadable_posts filter
Bidirectional fields now only add references to posts the current user can edit, terms they can assign, and users they can edit or set as a post's author. Saves made with update_field, WP-CLI, or cron are not checked, and the new acf/bidirectional/can_update_target and acf/is_trusted_save_context filters can adjust this. Thanks to vuxvinh via WPScan for the responsible disclosure
Alterações
Release Date 2nd November 2026
Inputs outside these rules, such as fields added with JavaScript, can be allowed with the `acf/form/{context}/allowed_field_keys` and `acf/options_page/allowed_field_keys` filters. Registration forms no longer save fields from field groups set to "User Form is Add / Edit". Thanks to vuxvinh via WPScan for the responsible disclosure
6.8.10
7 de segurança1 alteração
Segurança
ACF now validates that uploaded PDF files begin with the standard `%PDF-` header before further processing, rejecting files that do not match the expected format
The Relationship, Post Object, Image, Gallery, and File fields now enforce WordPress read permissions on referenced posts and attachments when returned in REST API responses
ACF now verifies both preview context and the caller's edit capability before substituting revision data when field values are retrieved for a post
The `_acf_form` token used by frontend forms now expires and is bound to its issuing render, and `acf_encrypt` / `acf_decrypt` gain an optional `$context` argument for domain separation between token uses
ACF now consistently runs field validation on frontend form submissions containing field data, ensuring required-field checks and custom `acf/validate_value` filters cannot be circumvented
ACF's REST API schema no longer discloses per-object field-group configuration in OPTIONS requests to callers who lack read permission on the target object
The User field AJAX endpoint now validates that the request nonce was created for a User field
Alterações
Release Date 10th September 2026
6.8.9
2 melhorias3 correções2 alterações
Melhoria
ACF Blocks registered via `acf_register_block_type` or `block.json` without an explicit version now default to v3 on WordPress 7.1 or later. Blocks that specify a version continue to use the version they declare, and the default can be customized via the `acf/blocks/default_block_version` filter
ACF Blocks v3 now supports a `renderPreview` option in `block.json`. Setting `"renderPreview": false` shows a placeholder with the block's icon, title, and an "Edit Block" button in the editor instead of rendering the block's template as a live preview. The block continues to render normally on the front-end, and legacy v2 blocks combining `"mode": "edit"` with `"supports": { "mode": false }` are automatically migrated when upgraded to v3
Corrigido
Inline editable fields in ACF Blocks V3 no longer require a second click before they can be edited
Radio buttons now appear correctly in ACF admin screens
Image and Gallery fields no longer reject SVG uploads when the Safe SVG plugin is active
Alterações
Release Date 27th August 2026
[View Release Post]
6.8.8
1 correção1 alteração
Corrigido
Image and Gallery fields no longer reject SVG files
Alterações
Release Date 19th August 2026
6.8.7
6 de segurança1 alteração
Segurança
ACF Image and Gallery fields now enforce server-side validation to accept only image files
The `path` attribute of registered ACF Blocks is now protected from being overridden by client-supplied block data
ACF's `acf_encrypt` and `acf_decrypt` helpers now authenticate encrypted values with an HMAC and no longer fall back to base64 encoding when OpenSSL is unavailable
ACF's comment, user, and options page form save handlers now only save values for fields whose field groups are assigned to the current save context
The Post Object, Page Link, and Relationship field AJAX search queries now enforce WordPress read permissions, preventing unauthenticated visitors from seeing non-public post statuses or post types
The User field now returns only user IDs in REST API responses to requesters without the `list_users` capability, preventing unauthenticated visitors from seeing user email addresses
Alterações
Release Date 4th August 2026
6.8.6
7 correções1 alteração
Corrigido
Google Maps field values are no longer double-encoded when saved in an ACF block
Inserting a Link field value in the Classic Editor no longer triggers validation for other required fields before the post is saved
Auto Inline Editing blocks no longer return truthy placeholder strings for empty field values fetched from a different post inside the block render template
ACF Blocks (V2 and V3) no longer crash when rendering an oEmbed field whose title begins with `
Field group location rules without a location value no longer cause PHP warnings on page load
The appearance of the URL, Number, and Select fields has been improved on WordPress 7.0+
ACF fields now save on WooCommerce orders when using HPOS in compatibility mode
Alterações
Release Date 14th July 2026
6.8.5
4 de segurança1 alteração
Segurança
ACF PRO's save handler for WooCommerce order fields now verifies security nonces and only attaches on the order edit screen, preventing unauthenticated field value updates for stores utilizing HPOS
The Flexible Content "Rename Layout" modal no longer allows for the execution of a potential stored XSS vulnerability
A default limit of 1000 has been applied to user-contributed choices for Checkbox, Radio, and Select fields to improve security, with a new `acf/fields/max_appended_choices` filter available for customization
Special characters within LIKE patterns are now fully escaped in `wp_options` queries via `$wpdb->esc_like`
Alterações
Release Date 30th June 2026
6.8.4
1 melhoria4 correções1 de segurança1 alteração
Melhoria
`acf_inline_toolbar_editing_attrs` now accepts a `return_array` argument that returns the attributes as an escaped array suitable for use with `wp_get_attachment_image`
Corrigido
`acf_form` with `'post_id' => 'new_post'` and a `fields` list of field names no longer fatal errors when `acf_form_head` runs before WordPress's main query is built
Multiple `acf_form` calls wrapped inside a single outer ` ` tag with one submit button no longer silently drop field values, `post_title`, or `post_content` from the non-last forms
Duplicating a V3 block with identical attributes no longer displays corrupted preview content in the duplicate
Switching between tabs containing WYSIWYG fields no longer leaves the admin menu pinned against a shorter page, which could lock page scroll
Segurança
ACF AJAX field handlers now validate that the request nonce was created for the expected field type
Alterações
Release Date 10th June 2026
6.8.3
1 de segurança1 alteração
Segurança
The oEmbed field's AJAX preview no longer performs URL discovery for users without the `edit_posts` capability.
Alterações
Release Date 2nd June 2026
6.8.2
2 de segurança1 alteração
Segurança
ACF frontend forms (`acf_form`) now respect the `post_title` and `post_content` form configuration options when processing submissions, ensuring those values are only saved when the form is configured to accept them. Thanks to Sarawut Poolkhet (MisterHelloz) for the responsible disclosure.
ACF frontend forms (`acf_form`) now only save values for fields assigned to the form via the `fields` or `field_groups` parameters, or via the form's location rules
Alterações
Release Date 26th May 2026
6.8.1
4 novos5 correções1 de segurança1 alteração
Novo
A `wp.data` store (`acf/fields`) is now available in ACF PRO for reading and writing ACF field values from JavaScript, which can be enabled via a new `acf/settings/enable_datastore` filter (requires WordPress 6.7 or later).
ACF PRO block bindings now support live preview and editing in the block editor, when both the datastore and the `enable_block_bindings` setting are enabled.
ACF PRO can now save metabox field values via Gutenberg's native REST flow with full revision and autosave support when using the datastore.
ACF PRO Blocks can now define their field group inline via an `acf.fields` array in `block.json`, or via a `fields` argument in `acf_register_block_type`, with field keys auto-generated and scoped to the block
Corrigido
Repeater and Flexible Content row helpers no longer trigger a PHP 8.x `TypeError` when `row_index_offset` or the active loop index is non-numeric
V3 Blocks with `hideFieldsInSidebar` enabled no longer show fields in the sidebar after the inline toolbar popover is closed
Scrollbars no longer appear under the tabs in field groups containing many tabs
The `acf/delete-{taxonomy}` ability no longer returns a 501 error when called without an explicit `force` argument, as terms cannot be trashed
The `prepare_field_for_ability_import` filter is now correctly removed after each Abilities field group import, preventing subsequent imports in the same request from having values corrupted
Segurança
ACF now correctly checks user permissions before running database upgrades on a specific site in a multisite network
Alterações
Release Date 13th May 2026
6.8.0.1
2 correções2 alterações
Corrigido
V3 blocks with WYSIWYG fields no longer enqueue TinyMCE editor assets on the frontend
V3 blocks with identical attributes and different InnerBlocks content no longer return cached output from the first block on the frontend
Alterações
Release Date 31st March 2026
PRO Only Release
6.8.0
4 novos7 melhorias14 correções3 alterações
Novo
ACF now integrates with the WordPress Abilities API, allowing external consumers (AI tools) to manage field groups, post types, and taxonomies when explicitly enabled via the `enable_acf_ai` feature flag
ACF can now generate JSON-LD structured data fields when explicitly enabled via the `enable_schema` feature flag
ACF now includes WP-CLI support with new `wp acf json` commands for importing, exporting, syncing, and checking the status of ACF JSON files
ACF custom post Types now support the WordPress 6.9+ "Notes" editor feature via a new "Notes" checkbox in the Supports settings
Melhoria
The Blocks V3 "Open in Expanded Editor" button text can now be customized via a new `acf.expandedEditorButtonText` block.json property
A new `acf/blocks/default_expanded_editor_button_text` PHP filter allows customizing the default "Open in Expanded Editor" button text for all V3 blocks
The Blocks V3 edit and "Open in Expanded Editor" buttons can now be hidden via a new `acf.expandedEditorButtons` block.json property
A new `blocks/expanded_editor_overlay_class` JS filter allows customizing the CSS class on the Expanded Editor modal overlay
ACF Blocks V3 now preloads the block form HTML alongside the preview, eliminating an extra AJAX call on mount
ACF inline script tags now use `wp_print_inline_script_tag` for Content Security Policy (CSP) compliance and nonce support
The Expanded Editor buttons are now hidden for V3 blocks that have no fields assigned
Corrigido
Flexible Content fields now properly clean up nested postmeta when a parent layout containing nested Flexible Content fields is deleted
The Expanded Editor "Done" button now stays disabled until the AJAX save completes, preventing data loss
Pressing Escape while the Expanded Editor is saving will no longer close the modal, preventing data loss
InnerBlocks content containing backslashes or dollar signs now renders correctly
Auto Inline Editing now only applies to ACF Blocks V3, resolving incorrect hover/focus borders appearing on V2 blocks
Validation errors in the V3 Expanded Editor no longer cause a dead-end state
Icon Picker selections in Repeater fields no longer disappear
Range field number input now syncs to the slider and correctly updates V3 block previews
Message field Name and Instructions settings are no longer shown in the field group editor
Image field no longer crashes in WordPress 7.0 release candidates
Auto Inline Editing blocks now receive block context variables in render templates
V3 blocks registered via PHP now correctly show the "Open in Expanded Editor" button
Flexible Content disabled layouts now work correctly in Blocks V3
Auto Inline Editing now works with blocks using `renderCallback`
Alterações
Release Date 30th March 2026
[View Release Post]
i18n - Added Danish translation
6.7.2
5 de segurança1 alteração
Segurança
Users' `unfiltered_html` capability is now correctly applied to REST API calls
Block Preview rendering now correctly checks the user has permission to edit that post
Repeater fields using pagination now correctly checks the user has permissions to edit that post
Flexible content fields layout title AJAX requests now correctly verify security nonces
Clone field AJAX admin endpoints now correctly check ACF admin permissions for field group listings
Alterações
Release Date 26th March 2026
6.7.1
2 de segurança1 alteração
Segurança
User field AJAX queries now enforce field-configured role restrictions and validate search permissions
Post Object, Relationship, and Page Link field AJAX queries now enforce field-configured restrictions for post status, post type, and taxonomy
Alterações
Release Date 3rd March 2026
Changelog publicado pelo desenvolvedor, no idioma original.
