Login Request a demo
Medium severity · published Aug 1, 2026
CVE-2026-17580
Advanced Views <= 3.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via 'view-refresh' and 'card-refresh' REST Endpoints
6.5
CVSS
0.6%
EPSS
No
On KEV
Description
The Advanced Views – Display Custom Fields (ACF, Pods, MetaBox), Posts, CPT and Woo Products anywhere in Gutenberg, Elementor, Divi, Beaver… plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.9.1 via the register_rest_routes. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract sensitive admin-authored editor content — including template markup, CSS code, JavaScript code, and PHP controller variables — for any Layout or Post Selection post on the site.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 46% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AV
Advanced Views – Display Custom Fields (ACF, Pods, MetaBox), Posts, CPT and Woo Products anywhere in Gutenberg, Elementor, Divi, Beaver… · wplakeorg
through 3.9.1 · source: vendor
Affected product
AV
Advanced Views – Display Custom Fields (ACF, Pods, MetaBox), Posts, CPT and Woo Products anywhere in Gutenberg, Elementor, Divi, Beaver…
wplakeorg
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-17580
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-17580
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/acf-views/tags/3.9.0/src/Cpt/Base/Cpt/Cpt_Interactive_Fields.php#L77
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/acf-views/tags/3.9.0/src/Cpt/Base/Cpt/Cpt_Interactive_Fields.php#L98
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/acf-views/tags/3.9.0/src/Cpt/Layouts/Cpt/Layout_Interactive_Fields.php#L74
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/acf-views/tags/3.9.0/src/Cpt/Post_Selections/Cpt/Selection_Interactive_Fields.php#L30
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/acf-views/tags/3.9.1/src/Cpt/Base/Cpt/Cpt_Interactive_Fields.php#L77
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/acf-views/tags/3.9.1/src/Cpt/Base/Cpt/Cpt_Interactive_Fields.php#L98
More from Advanced Views – Display Custom Fields (ACF, Pods, MetaBox), Posts, CPT and Woo Products anywhere in Gutenberg, Elementor, Divi, Beaver…
8.8
CVE-2025-10380
Advanced Views – Display Posts, Custom Fields, and More <= 3.7.19 - Authenticated (Author+) Remote Code Execution via SSTI