CVE-2026-17580
Received Received - Intake

Sensitive Information Exposure in Advanced Views WordPress Plugin

Publication date: 2026-08-01

Last updated on: 2026-08-01

Assigner: Wordfence

Description
The Advanced Views – Display Custom Fields (ACF, Pods, MetaBox), Posts, CPT and Woo Products anywhere in Gutenberg, Elementor, Divi, Beaver… plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.9.1 via the register_rest_routes. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract sensitive admin-authored editor content — including template markup, CSS code, JavaScript code, and PHP controller variables — for any Layout or Post Selection post on the site.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-01
Last Modified
2026-08-01
Generated
2026-08-01
AI Q&A
2026-08-01
EPSS Evaluated
N/A
NVD
CVE-2026-17580
EUVD
EUVD-2026-51762

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
advanced_views display_custom_fields to 3.9.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This WordPress plugin vulnerability allows authenticated users with subscriber-level access or higher to access sensitive admin-authored content through exposed REST API routes. Attackers can retrieve template markup, CSS, JavaScript, and PHP variables from any post or layout on the site.

Detection Guidance

Check for unauthorized access to sensitive admin content via REST API endpoints. Inspect logs for unusual requests to register_rest_routes or exposure of template markup, CSS, JavaScript, or PHP variables. Use WordPress security plugins to monitor REST API activity.

Impact Analysis

An attacker could steal proprietary frontend code, website templates, or internal PHP variables. This may lead to intellectual property theft, website defacement, or further exploitation if PHP variables contain sensitive configuration data.

Compliance Impact

This vulnerability could expose sensitive frontend code or configuration data, potentially violating data protection requirements under GDPR or HIPAA if such data includes personal or protected information. Compliance may be impacted if unauthorized access occurs.

Mitigation Strategies

Update the plugin to the latest version if available. Restrict subscriber-level access to sensitive content. Disable REST API endpoints if not required. Implement a web application firewall to block unauthorized requests.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-17580. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart