Advanced Custom Fields: Extended <= 0.9.2.7 - Missing Authorization to Unauthenticated Data Exposure via Multiple AJAX Endpoints

Advanced Custom Fields: Extended · Missing authorization · CWE-862

AffectedAdvanced Custom Fields: Extended

FixNo fix listed yet.

PublishedOct 28, 06:45 · Wordfence

ScoredOct 28 · 5.3 · Wordfence

Exploit code publicNone known · checked 21:18 UTC

ExploitedNone known · CISA KEV checked 22:08 UTC

What we know

No known exploitation. CISA KEV, checked 22:08 UTC.

No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.

An attacker only needs network access to the target. No login needed. CVSS: network, no privileges.

Description

The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to unauthorized access of data and triggering of server-side actions in all versions up to, and including, 0.9.2.7. This is due to multiple AJAX handlers registered for unauthenticated users (`wp_ajax_nopriv_*`) that fail to implement proper `current_user_can()` authorization checks. While these handlers use ACF's `acf_verify_ajax()` function to validate cryptographic nonces, the `acf_nonce` values are generated for guest users and publicly exposed in the page source of any frontend page utilizing an ACF form. This makes it possible for unauthenticated attackers to extract the guest nonce and bypass WordPress visibility permissions, leading to the unauthorized disclosure of post titles and internal Flexible Content layout structures. The vulnerability was partially patched in version 0.9.2.4.

From Wordfence

Affected and fixed versions

ProductAffectedFixed inAdvanced Custom Fields: Extendedup to 0.9.2.7–

Exploit code

Exploit-DBnone knownMetasploitnone knownNucleinone known

References

Other CVEs in Advanced Custom Fields: Extended

All 7 →

7.5The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 0.9.2.7 via… · CVE-2026-110305Oct 30 4.8Advanced Custom Fields: Extended <= 0.9.2.6 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via Email Action Dynamic File Field · CVE-2026-10752Oct 27 9.8Advanced Custom Fields: Extended <= 0.9.2.5 - Unauthenticated Privilege Escalation via Validation Bypass to '_acf_post_id' Parameter · CVE-2026-8809May 28