Advanced Custom Fields Pro v6.8.7

*Release Date 4th August 2026* * Security - ACF Image and Gallery fields now enforce server-side validation to accept only image files * Security - The `path` attribute of registered ACF Blocks is now protected from being overridden by client-supplied block data * Security - ACF's `acf_encrypt()` and `acf_decrypt()` helpers now authenticate encrypted values with an HMAC and no longer fall back to base64 encoding when OpenSSL is unavailable * Security - ACF's comment, user, and options page form save handlers now only save values for fields whose field groups are assigned to the current save context * Security - The Post Object, Page Link, and Relationship field AJAX search queries now enforce WordPress read permissions, preventing unauthenticated visitors from seeing non-public post statuses or post types * Security - The User field now returns only user IDs in REST API responses to requesters without the `list_users` capability, preventing unauthenticated visitors from seeing user email addresses