AAdvanced Custom Fields: version, compatibility and updates

Advanced Custom Fields is a WordPress plugin with 2+ million active installs. The current version on WordPress.org is 6.8.10, last updated on 10 September 2026.

Facts from WordPress.org

Does Advanced Custom Fields work with WordPress 7.2?

Advanced Custom Fields says it was tested up to WordPress 7.1.4. It does not yet say it has been tested with WordPress 7.2. See the full WordPress 7.2 compatibility list.

What the plugin says about itself

Advanced Custom Fields (ACF®) turns WordPress sites into a fully-fledged content management system by giving you all the tools to do more with your data. Use the ACF plugin to take full control of your WordPress edit screens, custom field data, and more. Add fields on demand. The ACF field builder allows you to quickly and easily add fields to WP edit screens with only the click of a few buttons! Whether it’s something simple like adding an “author” field to a book review post, or something more complex like the structured data needs of an ecommerce site or marketplace, ACF makes adding fields to your content model easy. Add them anywhere. Fields can be added all over WordPress including posts, pages, users, taxonomy terms, media, comments and even custom options pages! It couldn’t be simpler to bring structure to the WordPress content creation experience. Show them everywhere. Load and …

Newest changelog entry

6.8.10 Release Date 10th September 2026 Security – ACF now validates that uploaded PDF files begin with the standard %PDF- header before further processing, rejecting files that do not match the expected format Security – The Relationship, Post Object, Image, Gallery, and File fields now enforce WordPress read permissions on referenced posts and attachments when returned in REST API responses Security – ACF now verifies both preview context and the caller’s edit capability before substituting revision data when field values are retrieved for a post Security – The _acf_form token used by frontend forms now expires and is bound to its issuing render, and acf_encrypt() / acf_decrypt() gain an optional $context argument for domain separation between token uses Security – ACF now consistently runs field validation on frontend form submissions containing field data, ensuring required-field checks and custom acf/validate_value filters cannot be circumvented Security – ACF’s REST API schema no longer discloses per-object field-group configuration in OPTIONS requests to callers who lack read permission on the target object Security – The User field AJAX endpoint now validates that the request nonce was created for a User field

Recent releases

Days are when each version's tag was created in WordPress.org's code repository.

Questions