ACF Extended CVE-2026-2839

Exploitation requires a deployed site running ACF Extended (≤0.9.2.7) that serves at least one frontend page utilizing an ACF form - that page is what exposes the guest acf_nonce in its source, which is the exact prerequisite the attacker needs to pass acf_verify_ajax(). Where no public-facing ACF form is rendered, the guest nonce is not exposed and the nopriv handlers are harder to reach. The flaw was only partially patched in 0.9.2.4, so sites on 0.9.2.4 through 0.9.2.7 remain affected. No authentication, user interaction, or non-default configuration beyond using ACF forms on public pages is required; impact is confined to disclosure of post titles and Flexible Content layout structures.

This is a genuine but moderate-severity issue, not a critical emergency. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N = 5.3) describes a remote, unauthenticated, low-complexity attack with only LOW confidentiality impact and NO integrity or availability impact - consistent with CWE-862 (Missing Authorization) and the description, which limits disclosure to post titles and internal Flexible Content layout structures. No EPSS score, no CISA KEV listing, and no confirmed public exploit code were provided, so the strongest exploitation signals are absent. The vuln.today decision label is 'this_month' (not act_now or emergency), which aligns with the picture of a real-but-low-impact information-disclosure flaw rather than a high-CVSS issue with low real risk. The PR:N rating is credible here precisely because the acf_verify_ajax() nonce check is defeated by a guest nonce that is publicly exposed in frontend page source - so the one authorization control present does not actually restrict unauthenticated callers. The limiting factor is impact, not reachability: an attacker gains metadata (titles and layout structure), not post content, credentials, or write access.

An unauthenticated attacker loads any public frontend page that renders an ACF form, scrapes the guest acf_nonce value from the page source, and replays it against the plugin's wp_ajax_nopriv_* handlers. Because those handlers validate only the (guest-obtainable) nonce and omit current_user_can() checks, the attacker enumerates otherwise-hidden post titles and internal Flexible Content layout structures using ordinary HTTP requests. No public exploit code was identified in the provided data; the attack is low-complexity and requires no user interaction.