JPKCom DB
View on GitHub (opens in a new tab)

JPKCom ACF (Pro) Enable Shortcode — Guide & Tips

Output ACF field values via shortcode inside a WYSIWYG — installation and practical tips for JPKCom ACF (Pro) Enable Shortcode.

JPKCom ACF (Pro) Enable Shortcode enables the ACF shortcode that lets you display another field's value from within the WYSIWYG editor. It unlocks a capability that Advanced Custom Fields does not enable by default for security reasons.

Guide

Requirements

Installation

  1. In your admin panel, go to Plugins → Add New and click Upload Plugin.
  2. Choose the plugin's ZIP file and click Install Now.
  3. Make sure Advanced Custom Fields is activated.
  4. Click Activate — the plugin takes effect immediately.

Usage

Once active, you can use the ACF shortcode inside a WYSIWYG field to display another field's value. See the official ACF shortcode documentation (opens in a new tab) for the supported syntax and details.

The plugin does not just switch the shortcode on once, it keeps it on: the setting is filtered on every read, so a later change from elsewhere cannot quietly switch it off again. On block themes it additionally lifts ACF's separate restriction that otherwise limits the shortcode to post content, so [acf] also works in template parts, widgets and blocks outside the content flow.

If your ACF installation predates 6.3, the shortcode is already enabled and this plugin changes nothing.

When the shortcode still outputs nothing

Enabling the shortcode is necessary but not sufficient. ACF additionally requires that the field is registered (a bare post meta value is not enough — ACF resolves the name through its _fieldname reference row), that the field type supports bindings, and that the referenced post is publicly viewable. Previews need the publish_posts capability. When one of these is not met, the shortcode outputs nothing, silently.

Tips & Tricks

  • Enable deliberately: ACF disables the shortcode by default — though only on installations first activated on ACF 6.3 or later. Both restrictions are hardening defaults ACF introduced on purpose. Only activate this plugin if you actually need the feature, and keep an eye on who is allowed to edit content with shortcodes. ACF's own output escaping is left untouched.
  • Block themes since 2.0.9: Before that, the [acf] shortcode simply produced nothing outside the_content on a block theme — with no error and no log entry. Classic themes were never affected. Note that lifting this restriction deliberately widens the scope beyond post content.
  • Look up the syntax: The attributes the ACF shortcode accepts (e.g. field name, post ID, formatting) are documented on the ACF shortcode resource page (opens in a new tab).
  • Verified against ACF Pro 6.8.6: Requires Plugins: advanced-custom-fields-pro resolves against the installed plugin folder even though ACF Pro is not on wordpress.org — only the "install dependency" link is unavailable.
  • Reproducible updates: Since version 2.0.3 the plugin uses secure self-hosted updates via GitHub with SHA256 checksums and runs with declare(strict_types=1). Since 2.0.10 it also carries the Update URI header: the wordpress.org update API then no longer returns updates for this plugin, so a plugin published there under the same slug cannot pose as an update. Since 2.0.11 Dashboard → Updates shows the JPKCom logo next to the plugin instead of the generic pattern.
  • Updates while deactivated since 2.0.12: WordPress never runs the code of a deactivated plugin, so its own updater never ran. With updater 1.5.0, one loaded JPKCom updater serves every installed JPKCom plugin, active or not — the update row, the icon, "View details" and the SHA256 check then apply to this plugin while it is deactivated, too. This only works as long as another JPKCom plugin with updater 1.5.0 or later is active; on multisite it must be network-active or active on the main site. JPKCom download URLs are no longer kept in the stored update list, the checksum also verifies packages another plugin supplies, and a Git checkout only gets the notice about the new release, never an update package — updating it is up to you. The same applies to an active plugin in a renamed folder (such as jpkcom-acf-shortcode-enable-main); while deactivated, the updater does not recognise such a folder at all. The updater fetches update information only for users who can update plugins, in the update cron and in WP-CLI — never for anonymous visitors.

Further reading