CVE-2026-17580

Deferred Deferred - Pending Action

Sensitive Information Exposure in Advanced Views WordPress Plugin

Publication date: 2026-08-01

Last updated on: 2026-08-12

Assigner: Wordfence

Description

The Advanced Views – Display Custom Fields (ACF, Pods, MetaBox), Posts, CPT and Woo Products anywhere in Gutenberg, Elementor, Divi, Beaver… plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.9.1 via the register_rest_routes. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract sensitive admin-authored editor content — including template markup, CSS code, JavaScript code, and PHP controller variables — for any Layout or Post Selection post on the site.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-01

Last Modified

2026-08-12

Generated

2026-11-08

AI Q&A

2026-08-01

EPSS Evaluated

2026-11-07

NVD

CVE-2026-17580

EUVD

EUVD-2026-51762

Affected Vendors & Products

Vendor	Product	Version / Range
advanced_views	display_custom_fields	to 3.9.1 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This WordPress plugin vulnerability allows authenticated users with subscriber-level access or higher to access sensitive admin-authored content through exposed REST API routes. Attackers can retrieve template markup, CSS, JavaScript, and PHP variables from any post or layout on the site.

Detection Guidance

Check for unauthorized access to sensitive admin content via REST API endpoints. Inspect logs for unusual requests to register_rest_routes or exposure of template markup, CSS, JavaScript, or PHP variables. Use WordPress security plugins to monitor REST API activity.

Impact Analysis

An attacker could steal proprietary frontend code, website templates, or internal PHP variables. This may lead to intellectual property theft, website defacement, or further exploitation if PHP variables contain sensitive configuration data.

Compliance Impact

This vulnerability could expose sensitive frontend code or configuration data, potentially violating data protection requirements under GDPR or HIPAA if such data includes personal or protected information. Compliance may be impacted if unauthorized access occurs.

Mitigation Strategies

Update the plugin to the latest version if available. Restrict subscriber-level access to sensitive content. Disable REST API endpoints if not required. Implement a web application firewall to block unauthorized requests.

Hi! I’m here to help you understand CVE-2026-17580. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...