Read the docs
TI-2026-81718 Aliases CVE-2026-2839GHSA-6687-wfp7-4mp6

Missing authorization in Advanced Custom Fields: Extended

Priority LOW 30CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Low · None · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

Advanced Custom Fields: Extended, a WordPress plugin from hwk-fr, is affected in all versions up to and including 0.9.2.7. Multiple AJAX handlers registered for unauthenticated users lack current_user_can() authorization checks, which is a missing authorization flaw (CWE-862). An unauthenticated remote attacker can take the guest nonce from a frontend page source and use it to read post titles and internal Flexible Content layout structures.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to unauthorized access of data and triggering of server-side actions in all versions up to, and including, 0.9.2.7. This is due to multiple AJAX handlers registered for unauthenticated users (`wp_ajax_nopriv_*`) that fail to implement proper `current_user_can()` authorization checks. While these handlers use ACF's `acf_verify_ajax()` function to validate cryptographic nonces, the `acf_nonce` values are generated for guest users and publicly exposed in the page source of any frontend page utilizing an ACF form. This makes it possible for unauthenticated attackers to extract the guest nonce and bypass WordPress visibility permissions, leading to the unauthorized disclosure of post titles and internal Flexible Content layout structures. The vulnerability was partially patched in version 0.9.2.4.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00275 19th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
hwk-frAdvanced Custom Fields: Extendedup to 0.9.2.7—No fix listedCNA
  • Advanced Custom Fields: Extended Vendorhwk-fr Affected up to 0.9.2.7 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for Advanced Custom Fields: Extended. The vulnerability was partially patched in version 0.9.2.4.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Timeline

  1. 2026-10-28 Threatist record created from CVE-2026-2839
  2. 2026-10-28 Alias added: GHSA-6687-wfp7-4mp6
  3. 2026-10-29 CISA SSVC decision points changed

References

Other 7

  • TI-2025-12329 Advanced Custom Fields: Extended 0.9.0.5 - 0.9.1.1 - Unauthenticated Remote Code Execution in prepare_form CVSS 3.1CRITICAL 9.8
  • TI-2025-13276 Advanced Custom Fields: Extended <= 0.9.2.1 - Unauthenticated Privilege Escalation via Insert User Form Action CVSS 3.1CRITICAL 9.8
  • TI-2026-07743 Improper privilege management in hwk-fr Advanced Custom Fields: Extended CVSS 3.1CRITICAL 9.8
  • TI-2026-83241 Advanced Custom Fields: Extended exposes user password hashes CVSS 3.1HIGH 7.5
  • TI-2025-14104 Advanced Custom Fields: Extended <= 0.9.2.3 - Unauthenticated Arbitrary Shortcode Execution CVSS 3.1MEDIUM 6.5
  • TI-2024-21446 WordPress WP 404 Auto Redirect to Similar Post plugin <= 1.0.4 - Reflected Cross Site Scripting (XSS) vulnerability CVSS 3.1HIGH 7.1
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences