{"id":"CVE-2026-2839","kind":"vulnerability","aliases":["CVE-2026-2839"],"related":[],"title":"WordPress ACF Extended plugin: unauthenticated AJAX leaks post titles and layouts","description":"The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to unauthorized access of data and triggering of server-side actions in all versions up to, and including, 0.9.2.7. This is due to multiple AJAX handlers registered for unauthenticated users (`wp_ajax_nopriv_*`) that fail to implement proper `current_user_can()` authorization checks. While these handlers use ACF's `acf_verify_ajax()` function to validate cryptographic nonces, the `acf_nonce` values are generated for guest users and publicly exposed in the page source of any frontend page utilizing an ACF form. This makes it possible for unauthenticated attackers to extract the guest nonce and bypass WordPress visibility permissions, leading to the unauthorized disclosure of post titles and internal Flexible Content layout structures. The vulnerability was partially patched in version 0.9.2.4.","summary":"The Advanced Custom Fields: Extended WordPress plugin registers AJAX handlers for logged-out visitors without proper permission checks. An unauthenticated attacker can grab a publicly exposed guest nonce and use it to read post titles and internal Flexible Content layout structures, and trigger some server-side actions.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["acf","package","self-hosted","wordpress","wordpress-plugin"],"not_affected_if":["no-frontend-acf-forms","plugin-not-installed"],"how_to_check":"- Check the installed version of Advanced Custom Fields: Extended in the WordPress admin plugins list, or with `wp plugin get acf-extended --field=version`\n- Look for the plugin's `wp_ajax_nopriv_` handlers in its code if you maintain a fork","fix":"- Update Advanced Custom Fields: Extended to a version later than `0.9.2.7` (the sources say the issue was only partially patched in `0.9.2.4`, so do not stop at that version)\n- If no fixed version is available, deactivate the plugin or restrict the affected AJAX actions","status":"open","published_at":"2026-10-28T07:16:48+00:00","first_seen_at":"2026-10-28T07:31:38+00:00","triaged_at":"2026-10-28T07:33:21+00:00","updated_at":"2026-10-28T07:33:21+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-28T07:33:21Z","model":"claude-haiku-5-5","output":{"fix":"- Update Advanced Custom Fields: Extended to a version later than `0.9.2.7` (the sources say the issue was only partially patched in `0.9.2.4`, so do not stop at that version)\n- If no fixed version is available, deactivate the plugin or restrict the affected AJAX actions","reach":"internet","title":"WordPress ACF Extended plugin: unauthenticated AJAX leaks post titles and layouts","impact":"medium","summary":"The Advanced Custom Fields: Extended WordPress plugin registers AJAX handlers for logged-out visitors without proper permission checks. An unauthenticated attacker can grab a publicly exposed guest nonce and use it to read post titles and internal Flexible Content layout structures, and trigger some server-side actions.","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin","acf","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"unauthenticated visitors read post titles and internal layout data","analyst_note":"Confirm the fixed version past 0.9.2.7 and the exact list of affected AJAX actions from the plugin changelog or the Wordfence/NVD entry.","how_to_check":"- Check the installed version of Advanced Custom Fields: Extended in the WordPress admin plugins list, or with `wp plugin get acf-extended --field=version`\n- Look for the plugin's `wp_ajax_nopriv_` handlers in its code if you maintain a fork","needs_analyst":true,"not_affected_if":["plugin-not-installed","no-frontend-acf-forms"],"who_is_affected":"Sites running Advanced Custom Fields: Extended up to and including `0.9.2.7` that use ACF forms on public frontend pages, since the guest nonce is printed in the page source there. Sites that do not run the plugin, or run a version the sources do not list as affected, can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000701,"input_tokens":3522,"output_tokens":698,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-2839':14A,17A '0.9.2.4':206C '0.9.2.7':105C 'access':88C 'acf':2A,18B,134C,136C,145C,166C 'action':75B,97C 'advanc':28B,77C 'ajax':6A,35B,111C,118C,138C 'attack':48B,174C 'author':128C 'bypass':181C 'check':45B,129C 'content':66B,196C 'cryptograph':142C 'current':125C 'custom':29B,78C 'cve':12A,15A 'data':90C 'disclosur':189C 'due':108C 'expos':53B,155C 'extend':3A,31B,80C 'extract':176C 'fail':121C 'field':30B,79C 'flexibl':65B,195C 'form':167C 'frontend':162C 'function':139C 'generat':149C 'grab':50B 'guest':54B,151C,178C 'handler':36B,112C,132C 'host':22B 'implement':123C 'includ':104C 'intern':64B,194C 'layout':11A,67B,197C 'lead':185C 'leak':7A 'log':39B 'logged-out':38B 'make':169C 'multipl':110C 'nonc':55B,143C,146C,179C 'nopriv':119C 'packag':19B 'page':158C,163C 'partial':202C 'patch':203C 'permiss':44B,184C 'plugin':4A,26B,33B,81C 'possibl':171C 'post':8A,61B,191C 'proper':43B,124C 'public':52B,154C 'read':60B 'regist':34B,113C 'self':21B 'self-host':20B 'server':73B,95C 'server-sid':72B,94C 'side':74B,96C 'sourc':159C 'structur':68B,198C 'titl':9A,62B,192C 'trigger':70B,92C 'unauthent':5A,47B,115C,173C 'unauthor':87C,188C 'use':57B,133C 'user':116C,126C,152C 'util':164C 'valid':141C 'valu':147C 'verifi':137C 'version':100C,205C 'visibl':183C 'visitor':41B 'vulner':85C,200C 'without':42B 'wordpress':1A,23B,25B,32B,83C,182C 'wordpress-plugin':24B 'wp':117C","nicknames":[],"mitigations":[],"who_affected":"Sites running Advanced Custom Fields: Extended up to and including `0.9.2.7` that use ACF forms on public frontend pages, since the guest nonce is printed in the page source there. Sites that do not run the plugin, or run a version the sources do not list as affected, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T07:16:48+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-2839","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-2839","severity":null,"published_at":"2026-10-28T07:16:48+00:00","modified_at":"2026-10-28T07:16:48+00:00","first_seen_at":"2026-10-28T07:31:38+00:00","fetched_at":"2026-10-28T07:31:38+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}