Live › vulnerability › CVE-2026-2839
Go to dashboardThe Advanced Custom Fields: Extended WordPress plugin registers AJAX handlers for logged-out visitors without proper permission checks. An unauthenticated attacker can grab a publicly exposed guest nonce and use it to read post titles and internal Flexible Content layout structures, and trigger some server-side actions.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 07:31 UTC. All times on this page are UTC.
Sites running Advanced Custom Fields: Extended up to and including 0.9.2.7 that use ACF forms on public frontend pages, since the guest nonce is printed in the page source there. Sites that do not run the plugin, or run a version the sources do not list as affected, can skip it.
No product ranges from the sources yet.
wp plugin get acf-extended --field=versionwp_ajax_nopriv_ handlers in its code if you maintain a fork0.9.2.7 (the sources say the issue was only partially patched in 0.9.2.4, so do not stop at that version)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to unauthorized access of data and triggering of server-side actions in all versions up to, and including, 0.9.2.7. This is due to multiple AJAX handlers registered for unauthenticated users (wp_ajax_nopriv_*) that fail to implement proper current_user_can() authorization checks. While these handlers use ACF's acf_verify_ajax() function to validate cryptographic nonces, the acf_nonce values are generated for guest users and publicly exposed in the page source of any frontend page utilizing an ACF form. This makes it possible for unauthenticated attackers to extract the guest nonce and bypass WordPress visibility permissions, leading to the unauthorized disclosure of post titles and internal Flexible Content layout structures. The vulnerability was partially patched in version 0.9.2.4.
This page as .md · .json · in your agent: get_signal("CVE-2026-2839")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.