CVE-2026-2839
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
The Advanced Custom Fields: Extended plugin for WordPress in all versions up to and including 0.9.2.7 is vulnerable to unauthorized data access and triggering of server-side actions due to multiple AJAX handlers registered for unauthenticated users (wp_ajax_nopriv_*) that fail to implement proper current_user_can() checks. While handlers use acf_verify_ajax() to validate nonces, acf_nonce values are generated for guest users and exposed in the page source, allowing unauthenticated attackers to bypass visibility permissions and disclose post titles and internal Flexible Content layout structures. The vulnerability was partially patched in version 0.9.2.4.
Risk Assessment
An unauthenticated attacker can access post information and internal structures that should be hidden. This can facilitate reconnaissance and further attacks against the site.
Recommendation
Update the Advanced Custom Fields: Extended plugin to a version later than 0.9.2.7 or disable it, then review the site for exposed nonces and unauthorized AJAX requests.
Other vulnerabilities in Advanced Custom Fields: Extended WordPress plugin
See all- CVE-2026-94267Critical
The Advanced Custom Fields: Extended WordPress plugin (and PRO) before 0.9.2.8 performs no capability check when updating a post through one of its front-end form actions. This allows unauthenticated visitors to overwrite arbitrary posts, including those storing field definitions, leading to arbitrary code execution on the server. Exploitation requires a published form whose post-update action maps both target and content to visitor-submitted values.
- CVE-2026-94268High
The Advanced Custom Fields: Extended WordPress plugin (and PRO) before 0.9.2.8 does not consistently resolve the target of the update-user action between authorization and execution in its front-end Forms module. This allows unauthenticated visitors to bypass the guard protecting administrator accounts, take over the site administrator's account, and obtain a valid session. Exploitation requires two separate front-end form configurations whose targets are mapped to visitor-submitted values.
- CVE-2026-94264Medium
The Advanced Custom Fields: Extended WordPress plugin (and PRO) before 0.9.2.8 does not validate or escape some form shortcode attributes that can take values from the visitor's request and are output without escaping. This allows users with a role as low as contributor to run arbitrary script in the browser of anyone led to open a crafted link or page, including a logged-in administrator. This is an incomplete fix for CVE-2023-5292.
- CVE-2026-94262High
The Advanced Custom Fields: Extended WordPress plugin (and PRO) before 0.9.2.8 does not verify that the requester is authorized to edit the targeted user account in the update-user action of its front-end Forms module, performing that check only for administrator accounts. This allows unauthenticated visitors to overwrite any non-administrator account's credentials and obtain a session for that account. Exploitation requires a published form whose user-update action maps its target to a visitor-submitted value.
Original NVD description (English source)
The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to unauthorized access of data and triggering of server-side actions in all versions up to, and including, 0.9.2.7. This is due to multiple AJAX handlers registered for unauthenticated users (`wp_ajax_nopriv_*`) that fail to implement proper `current_user_can()` authorization checks. While these handlers use ACF's `acf_verify_ajax()` function to validate cryptographic nonces, the `acf_nonce` values are generated for guest users and publicly exposed in the page source of any frontend page utilizing an ACF form. This makes it possible for unauthenticated attackers to extract the guest nonce and bypass WordPress visibility permissions, leading to the unauthorized disclosure of post titles and internal Flexible Content layout structures. The vulnerability was partially patched in version 0.9.2.4.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS