CVE-2026-2839 in Advanced Custom Fields Extended Plugin
Summary
by MITRE • 10/28/2026
The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to unauthorized access of data and triggering of server-side actions in all versions up to, and including, 0.9.2.7. This is due to multiple AJAX handlers registered for unauthenticated users (`wp_ajax_nopriv_*`) that fail to implement proper `current_user_can()` authorization checks. While these handlers use ACF's `acf_verify_ajax()` function to validate cryptographic nonces, the `acf_nonce` values are generated for guest users and publicly exposed in the page source of any frontend page utilizing an ACF form. This makes it possible for unauthenticated attackers to extract the guest nonce and bypass WordPress visibility permissions, leading to the unauthorized disclosure of post titles and internal Flexible Content layout structures. The vulnerability was partially patched in version 0.9.2.4.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/28/2026
The Advanced Custom Fields: Extended plugin for WordPress contains a critical security flaw affecting all versions up to and including 0.9.2.7, characterized by insufficient access control mechanisms within its AJAX handler infrastructure. The core of the vulnerability lies in the registration of multiple AJAX endpoints using the `wp_ajax_nopriv_*` hooks, which are explicitly designed to allow unauthenticated users to execute server-side actions. While these handlers incorporate a layer of security through ACF's `acf_verify_ajax()` function, which relies on cryptographic nonces for validation, this implementation is fundamentally flawed due to how those nonces are generated and distributed. The system generates guest-specific nonces that are publicly exposed in the HTML source code of any frontend page containing an Advanced Custom Fields form. This exposure allows attackers to easily extract valid authentication tokens without needing prior login credentials or complex exploitation techniques, effectively neutralizing the intended protection mechanism provided by nonce verification.
From a technical perspective, this vulnerability represents a classic case of broken access control where the assumption that nonces alone provide sufficient security is incorrect when combined with public accessibility and lack of role-based checks. The absence of proper `current_user_can()` authorization checks means that once an attacker obtains a valid guest nonce from the page source, they can craft malicious requests to trigger server-side actions intended for authenticated users or restricted data operations. This flaw enables unauthorized disclosure of sensitive information such as post titles and internal Flexible Content layout structures. These structural details are particularly valuable to attackers as they reveal the underlying architecture of the WordPress site, facilitating further reconnaissance and potentially aiding in more targeted attacks against specific content types or plugin configurations that rely on these flexible fields for data storage and presentation.
The operational impact of this vulnerability is significant, as it allows unauthenticated remote attackers to bypass standard WordPress visibility permissions and access administrative-level information without detection through traditional login failure logs. The disclosure of internal layout structures can lead to a deeper understanding of the site's content model, which may expose additional attack surfaces related to data validation or processing logic specific to those flexible fields. Although this vulnerability was partially patched in version 0.9.2.4, subsequent versions up to 0.9.2.7 remain vulnerable, indicating that earlier fixes did not fully address the root cause of improper authorization checks across all affected AJAX handlers. This partial patching history highlights the importance of comprehensive security reviews rather than incremental fixes when dealing with core authentication and authorization logic in widely used plugins.
To mitigate this risk, administrators should immediately update to a version of the Advanced Custom Fields: Extended plugin that fully resolves these access control issues, ensuring that all `wp_ajax_nopriv_*` handlers implement strict role-based capability checks using WordPress's native permission functions. Developers integrating similar functionality must ensure that nonces are not only validated but also tied to specific user roles or capabilities rather than relying solely on their cryptographic validity for guest users. Furthermore, it is advisable to audit other AJAX endpoints within the application to verify they do not suffer from similar flaws where public exposure of tokens combined with missing authorization checks leads to privilege escalation or data leakage. Aligning these practices with industry standards such as CWE-284 Improper Access Control and MITRE ATT&CK technique T1078 Valid Accounts can help prevent unauthorized access and ensure that security controls are robust against unauthenticated exploitation attempts.