Gutenberg Studio 1.7.5: security fixes for the included ACF Pro

Gutenberg Studio 1.7.5 is a security release. It patches the ACF Pro copy that ships inside the plugin, so please update even if everything looks fine on your site.

Security fixes for the included ACF Pro

Gutenberg Studio runs on its own copy of ACF Pro when you don't have ACF Pro installed. That copy stays at version 6.2.2, so we patch it ourselves when issues come up.

This release closes two critical issues (CVE-2024-34761 and CVE-2024-34762). A user with a Contributor account or higher could put extra settings into a block and make the site run PHP code or load files from the server. Blocks now always use the template and settings you created in Gutenberg Studio, no matter what is saved inside the block.

Sites where only admins and editors can log in were less exposed, but the update is still important.

The [acf] shortcode is now off

With the included ACF copy, the [acf] shortcode is now turned off, the same default as current ACF versions. This closes two more issues (CVE-2023-6701 and CVE-2024-4565): the shortcode could print unsafe HTML and read fields from other posts.

If you use the shortcode, you can turn it back on, and its output is now escaped. The Manage Custom Fields docs → show how. With your own ACF Pro installed, nothing changes: the shortcode follows ACF's own settings.

Using your own ACF Pro

If you install ACF Pro with your own license, Gutenberg Studio uses it instead of the included copy. You get the latest ACF version and its full admin, and your existing blocks keep working.

Fixes

• ACF Blocks pages no longer show the Safe Mode error on sites using SQLite, such as WordPress Studio.
• The "view documentation" link in the "ACF Pro not installed" notice now opens the right guide.

Update

Go to Dashboard → Updates, or download 1.7.5 from your account on dplugins.com.