Release Date 26th May 2026
- Security - ACF frontend forms (
acf_form()) now respect thepost_titleandpost_contentform configuration options when processing submissions, ensuring those values are only saved when the form is configured to accept them. Thanks to Sarawut Poolkhet (MisterHelloz) for the responsible disclosure. - Security - ACF frontend forms (
acf_form()) now only save values for fields assigned to the form via thefieldsorfield_groupsparameters, or via the form's location rules