Reply To: get_field returning null after update

• Matt Shaw

• November 12, 2021 at 5:30 pm

@robwent I definitely see where you’re coming from. I think part of the issue is that we underestimated the number of folks that are using get_field() to get values for fields that don’t technically exist or to get fields unrelated to ACF.

The other part of the issue is that this was part of a security fix, which we would typically prefer to hold off on disclosing until folks have had a chance to update. That said, we definitely could have done better at documenting this once we did release the update. We’ve since updated the docs for get_field() to include some notes about this change, and updated the release post to point to those notes.

Regarding how this change improves security – the problem with get_field() being able to get arbitrary values is that it opens up vulnerabilities with things like AJAX requests or form submissions where get_field() might be manipulated by the request data.