Technical impact
The vulnerability exists because the Advanced Views plugin fails to check user roles on its 'view-refresh' and 'card-refresh' REST endpoints. An authenticated attacker, even with subscriber-level access, can trigger these routes and retrieve admin‑authored content such as template markup, CSS, JavaScript, and PHP variables. This bypass of authorization (CWE‑862) allows the leakage of sensitive code and configuration data that should be protected, compromising confidentiality and potentially exposing proprietary logic.
Affected Systems
The issue affects the Advanced Views – Display Custom Fields plugin from wplakeorg, used in WordPress sites that embed custom fields, posts, custom post types, and WooCommerce products into page builders. Versions up to and including 3.9.1 are vulnerable. Any WordPress site that hosts this plugin and provides subscribers or higher roles is at risk, because those users can trigger the vulnerable REST API calls.
Risk and Exploitability
With a CVSS score of 6.5, the vulnerability carries moderate severity. The EPSS score of less than 1 % indicates a low current exploitation probability, and it is not listed in the CISA KEV catalog. An attacker only needs to authenticate with subscriber or higher privileges to request the endpoints and obtain sensitive data. While exploitation requires legitimate account access, the data exposed could be used to gain deeper insights or facilitate further attacks, making the overall risk moderate but non‑trivial, especially on sites that store proprietary code in the exposed fields.
