The WordPress security team, announced that they are invoking point 18 of the plugin directory guidelines and are forking Advanced Custom Fields (ACF) into a new plugin, Secure Custom Fields. SCF has been updated to remove commercial upsells and fix a security problem.
On October 3rd, the ACF team announced ACF plugin updates will come directly from their website. This was also communicated via a support notice in the WordPress.org support forum on Oct 5th. Sites that followed the ACF team’s instructions on “How to update ACF” will continue to get updates directly from WP Engine. On October 1st, 2024, WP Engine also deployed its own solution for updates and installations for plugins and themes across their customers’ sites in place of WordPress.org’s update service.
Sites that continue to use WordPress.org’s update service and have not chosen to switch to ACF updates from WP Engine can have the option update to switch to Secure Custom Fields.
However, these events do not affect ACF PRO users. All ACF PRO updates will continue to be served seamlessly from advancedcustomfields.com, requiring no action from PRO users.
So do you update to SCF or continue ACF?
Since SCF is new, I can’t comment on it yet, but I plan to try it. However, I’ve trusted ACF for years and love its functionality, so for now, I’ll continue using ACF for my clients.
How to Update ACF
In response to the situation, WP Engine’s engineering team has developed an alternative update mechanism for the free version of ACF. Although there are no immediate security concerns, this solution will ensure that users of the free version can continue to receive important updates in the future.
In order to update your site’s version of ACF and receive updates in the future, please follow these steps:
- Download the latest zip of the plugin
- Log in to your site
- Navigate to Plugins > Add new
- Upload the zip file
- Confirm you want to overwrite the existing ACF plugin
- Future updates for the plugin will be available in the WordPress admin as normal
