Defining post_title in hidden frontend form no longer possible #1019

Activity

1. faisalahammad commented on Oct 12, 2026

   

   faisalahammad

   on Oct 12, 2026

   Last edited by faisalahammad

   More actions

   Hi,

   I'm not on the ACF team, just a volunteer looking through issues, but I dug into this and I think the change is intended.

   From 6.8.2, frontend forms only save the post title and content when the form has post_title or post_content set to true. The changelog lists it as a security fix. Before that, a submitted _post_title value was saved even when the form had the title turned off. Since a hidden input is sent by the browser, anyone could change its value, so I guess that is why it was closed off.

   One way that should still work is setting the default title through the new_post argument. Those values come from the signed form data on the server, so the browser can't change them:

   acf_form( array(
   	'post_id'    => 'new_post',
   	'post_title' => false,
   	'new_post'   => array(
   		'post_type'   => 'my_cpt',
   		'post_status' => 'publish',
   		'post_title'  => 'Default Title',
   	),
   ) );

   If the title needs to be built from other data, the acf/pre_save_post filter (priority above 5) or WordPress's wp_insert_post_data filter should also work.

   Hope this helps. If the maintainers agree it is working as intended, maybe this one can be closed.