What is the CVSS score of CVE-2026-17580?

CVE-2026-17580 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Advanced Views CVE-2026-17580

EUVD-2026-51762 MEDIUM

Missing Authorization (CWE-862)

2026-08-01 Wordfence

GHSA-wfv8-4fgp-fr6r

PHP WordPress Authentication Bypass Information Disclosure Wordpress Plugin Advanced Views Display Custom Fields Acf Pods Metabox Posts Cpt And Woo Products Anywhere In Gutenberg Elementor Divi Beaver

6.5

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

PR:L reflects mandatory subscriber authentication; C:H for full admin template content exposure; I:N and A:N as no write or disruption capability exists.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 01, 2026 - 08:54 vuln.today

CVE Published

Aug 01, 2026 - 07:49 cve.org

MEDIUM 6.5

DescriptionCVE.org

The Advanced Views - Display Custom Fields (ACF, Pods, MetaBox), Posts, CPT and Woo Products anywhere in Gutenberg, Elementor, Divi, Beaver… plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.9.1 via the register_rest_routes. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract sensitive admin-authored editor content - including template markup, CSS code, JavaScript code, and PHP controller variables - for any Layout or Post Selection post on the site.

AnalysisAI

Sensitive information exposure in the Advanced Views WordPress plugin (wplakeorg, all versions ≤ 3.9.1) allows any authenticated subscriber-level user to harvest admin-authored editor content - including template markup, CSS, JavaScript, and PHP controller variables - via improperly authorized REST API routes. Wordfence identified the flaw across three CPT interactive field classes (base, Layout, and Post Selection). No public exploit code or CISA KEV listing exists at time of analysis, but the low authentication bar of subscriber-level access makes this trivially exploitable on any WordPress site with open user registration.

Technical ContextAI

The plugin registers WordPress REST API endpoints through register_rest_routes implementations in three CPT class files: Cpt_Interactive_Fields.php (lines 77 and 98), Layout_Interactive_Fields.php (line 74), and Selection_Interactive_Fields.php (line 30). The root cause is CWE-862 (Missing Authorization) - the REST route handlers do not enforce capability checks commensurate with the sensitivity of the returned data, permitting subscriber-level authenticated users to access content restricted to editor or administrator roles. The plugin bridges ACF, Pods, and MetaBox field frameworks with page builders (Gutenberg, Elementor, Divi, Beaver), making the exposed REST responses particularly information-rich: they can contain internal PHP controller variable state, field configuration logic, and layout markup authored by privileged users. The CPE identifier is cpe:2.3:a:wplakeorg:advanced_views_-_display_custom_fields_(acf,_pods,_metabox),_posts,_cpt_and_woo_products_anywhere_in_gutenberg,_elementor,_divi,_beaver…:*:*:*:*:*:*:*:*.

RemediationAI

An upstream fix is available via WordPress Plugin SVN changeset 3626967 (https://plugins.trac.wordpress.org/changeset?reponame=&old=3626967%40acf-views&new=3626967%40acf-views), however the exact patched release version number is not independently confirmed from the available data - update the plugin to the latest available version via the WordPress plugin dashboard and verify the installed version exceeds 3.9.1. As a compensating control on sites that cannot immediately update, disable open user registration to prevent unauthenticated actors from obtaining subscriber accounts, since PR:L is the binding exploitation prerequisite. Additionally, REST API access can be restricted to higher capability levels using an authorization plugin or custom mu-plugin that checks permissions on ACF Views REST routes - note that broad REST API blocking may break other WordPress features and plugin integrations. Do not rely on obscurity of the endpoint path as a mitigation, as REST route enumeration is trivial on WordPress.