Prepare 6.8.8 Release

[cbravobernal]

Release Date 11th June 2026

Security

• AJAX field handlers now validate that the request nonce was created for the expected field type, so a nonce minted for one field type can no longer be replayed against another field type's AJAX handler. The gallery field was also aligned with the typed nonce scheme used by all other AJAX fields.
• acf_decrypt() now treats malformed payloads as a decrypt failure and returns false instead of emitting PHP 8 warnings.

Enhancements

• acf_inline_toolbar_editing_attrs() now accepts a return_array argument that returns the attributes as an escaped array suitable for use with wp_get_attachment_image().

Fixes

• acf_form() with 'post_id' => 'new_post' and a fields list of field names no longer fatal errors when acf_form_head() runs before WordPress's main query is built.
• Multiple acf_form() calls wrapped inside a single outer form tag with one submit button no longer silently drop field values, post_title, or post_content from the non-last forms. A new acf/form/meta_ttl filter controls how long per-form metadata remains valid.
• Duplicating a V3 block with identical attributes no longer displays corrupted preview content in the duplicate.
• Switching between tabs containing WYSIWYG fields no longer leaves the admin menu pinned against a shorter page, which could lock page scroll.

[github-actions]

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

Core Committers: Use this line as a base for the props when committing in SVN:

Props cbravobernal.

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.