WP Engine fixed the vulnerability about a week ago [0]. The WP security team may have just backported the fix, even using the same line in their changelog [1].

WP Engine fixed the vulnerability about a week ago [0]. The WP security team may have just backported the fix, even using the same line in their changelog [1]. [0]: https://www.advancedcustomfields.com/changelog/ https://www.advancedcustomfields.com/changelog/ [1]: https://plugins.trac.wordpress.org/changeset?new=3164480%40advanced-custom-fields&old=3143016%40advanced-custom-fields#file590 https://plugins.trac.wordpress.org/changeset?new=3164480%40a...