CVE-2026-2839: Advanced Custom Fields: Extended <= 0.9.2.7 - Missing Authorization to Unauthenticated Data Exposure via Multiple AJAX Endpoints

Q: Who is exposed to this issue?

Sites running Advanced Custom Fields: Extended version 0.9.2.7 or earlier are affected. Exposure requires a frontend page that uses an ACF form, because that page publicly exposes the guest acf_nonce needed by the affected AJAX handlers.

Q: What does an attacker need to exploit it?

An attacker does not need an account, authentication, or user interaction. They need to obtain a guest nonce from the source of a frontend page using an ACF form and submit requests to the unauthenticated AJAX endpoints.

Q: What could an attacker access or do?

The issue can bypass WordPress visibility permissions, allowing disclosure of post titles and internal Flexible Content layout structures. The affected handlers can also trigger server-side actions without proper authorization checks.

Q: Does upgrading to version 0.9.2.4 fully resolve the issue?

No. Version 0.9.2.4 only partially patched the vulnerability, and versions through 0.9.2.7 are described as affected.

Published Oct 28, 2026

Updated

The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to unauthorized access of data and triggering of server-side actions in all versions up to, and including, 0.9.2.7. This is due to multiple AJAX handlers registered for unauthenticated users (wpajaxnopriv) that fail to implement proper currentusercan() authorization checks. While these handlers use ACF's acfverifyajax() function to validate cryptographic nonces, the acfnonce values are generated for guest users and publicly exposed in the page source of any frontend page utilizing an ACF form. This makes it possible for unauthenticated attackers to extract the guest nonce and bypass WordPress visibility permissions, leading to the unauthorized disclosure of post titles and internal Flexible Content layout structures. The vulnerability was partially patched in version 0.9.2.4.

Affected Software

1 affected component

ACF Extended Advanced Custom Fields: Extended<=0.9.2.7

Event History

Oct 28, 2026

CVE Published

via MITRE·06:45 AM

Data Sourced

via MITRE·06:45 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Sites running Advanced Custom Fields: Extended version 0.9.2.7 or earlier are affected. Exposure requires a frontend page that uses an ACF form, because that page publicly exposes the guest acf_nonce needed by the affected AJAX handlers.

What does an attacker need to exploit it?

An attacker does not need an account, authentication, or user interaction. They need to obtain a guest nonce from the source of a frontend page using an ACF form and submit requests to the unauthenticated AJAX endpoints.

What could an attacker access or do?

The issue can bypass WordPress visibility permissions, allowing disclosure of post titles and internal Flexible Content layout structures. The affected handlers can also trigger server-side actions without proper authorization checks.

Does upgrading to version 0.9.2.4 fully resolve the issue?

No. Version 0.9.2.4 only partially patched the vulnerability, and versions through 0.9.2.7 are described as affected.

CVE-2026-2839: Advanced Custom Fields: Extended <= 0.9.2.7 - Missing Authorization to Unauthenticated Data Exposure via Multiple AJAX Endpoints

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What could an attacker access or do?

Does upgrading to version 0.9.2.4 fully resolve the issue?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What could an attacker access or do?

Does upgrading to version 0.9.2.4 fully resolve the issue?