The Advanced Custom Fields: Extended plugin for WordPress suffers from missing authorization checks on multiple AJAX handlers. The handlers are accessible to unauthenticated users and use a cryptographic nonce that is generated for guest users and embedded in the page source. An attacker can extract this nonce and bypass WordPress visibility permissions, resulting in the unauthorized disclosure of post titles and the internal layout structures of Flexible Content fields.

All installations of Advanced Custom Fields: Extended up to and including version 0.9.2.7. The plugin is distributed by hwk-fr and is widely used in WordPress environments. Versions 0.9.2.4 and later contain a partial patch, while the vulnerability remains in all earlier releases.

The vulnerability carries a CVSS score of 5.3, indicating moderate severity, and no EPSS data is available. It is not listed in CISA’s KEV catalog. Attackers need only a public-facing form that uses the plugin to retrieve the guest nonce; no additional credentials or privileges are required. Once the nonce is obtained, the affected AJAX endpoints can return protected content, exposing sensitive information to unauthenticated users.