Huge security risk unless you pay in perpetuity

  • carltonbiobm

    (@carltonbiobm)


    1 month, 2 weeks ago

    ACF doesn’t allow you to update unless you pay in perpetuity, even if critical security vulnerabilities are found. This makes it a huge security liability. The plugin developers need to update it such that updates can be received without enabling paid functionality. This is the correct means of managing security; not leveraging huge security risks to try to make more money.

Viewing 1 replies (of 1 total)
  • Plugin Contributor Iain Poulson

    (@polevaultweb)

    1 month, 1 week ago

    Iain here, the product manager for ACF over at WP Engine 👋

    Just to clarify: this review is for the free ACF plugin, which always receives security updates at no cost. There’s no subscription required.

    ACF PRO is a separate paid plugin. Like most commercial WordPress plugins, updates including security fixes require an active subscription. This is common practice for commercial WordPress plugins.

    You can find more detail on our security policy at https://www.advancedcustomfields.com/security/

    If you’re running ACF PRO with a lapsed subscription and have security concerns, the free ACF plugin here is a fully supported alternative.

Viewing 1 replies (of 1 total)

You must be logged in to reply to this review.