---
id: "CVE-2026-2839"
kind: "vulnerability"
aliases: ["CVE-2026-2839"]
title: "WordPress ACF Extended plugin: unauthenticated AJAX leaks post titles and layouts"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["acf", "package", "self-hosted", "wordpress", "wordpress-plugin"]
not_affected_if: ["no-frontend-acf-forms", "plugin-not-installed"]
published_at: "2026-10-28T07:16:48+00:00"
first_seen_at: "2026-10-28T07:31:38+00:00"
updated_at: "2026-10-28T07:33:21+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2839", "first_seen_at": "2026-10-28T07:31:38+00:00"}]
---

# WordPress ACF Extended plugin: unauthenticated AJAX leaks post titles and layouts

The Advanced Custom Fields: Extended WordPress plugin registers AJAX handlers for logged-out visitors without proper permission checks. An unauthenticated attacker can grab a publicly exposed guest nonce and use it to read post titles and internal Flexible Content layout structures, and trigger some server-side actions.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of Advanced Custom Fields: Extended in the WordPress admin plugins list, or with `wp plugin get acf-extended --field=version`
- Look for the plugin's `wp_ajax_nopriv_` handlers in its code if you maintain a fork

## Fix

- Update Advanced Custom Fields: Extended to a version later than `0.9.2.7` (the sources say the issue was only partially patched in `0.9.2.4`, so do not stop at that version)
- If no fixed version is available, deactivate the plugin or restrict the affected AJAX actions

## Timeline

- 2026-10-28T07:31:38+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-2839

## From the sources

The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to unauthorized access of data and triggering of server-side actions in all versions up to, and including, 0.9.2.7. This is due to multiple AJAX handlers registered for unauthenticated users (`wp_ajax_nopriv_*`) that fail to implement proper `current_user_can()` authorization checks. While these handlers use ACF's `acf_verify_ajax()` function to validate cryptographic nonces, the `acf_nonce` values are generated for guest users and publicly exposed in the page source of any frontend page utilizing an ACF form. This makes it possible for unauthenticated attackers to extract the guest nonce and bypass WordPress visibility permissions, leading to the unauthorized disclosure of post titles and internal Flexible Content layout structures. The vulnerability was partially patched in version 0.9.2.4.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_