Data Exposure in Advanced Custom Fields: Extended Plugin for WordPress

CVE-2026-2839

What is CVE-2026-2839?

The Advanced Custom Fields: Extended plugin for WordPress is prone to unauthorized data access, allowing unauthenticated users to exploit multiple AJAX handlers designed for guest users. These handlers do not enforce the necessary current_user_can() authorization checks, exposing cryptographic nonces in public-facing pages. This flaw enables attackers to bypass visibility permissions, potentially disclosing sensitive information such as post titles and internal content structures. Though there was a partial patch in version 0.9.2.4, the vulnerability persists in earlier versions.

References