CVE-2026-17580 Overview
CVE-2026-17580 is a sensitive information exposure vulnerability in the Advanced Views WordPress plugin. The plugin displays custom fields from ACF, Pods, and MetaBox, along with posts, custom post types, and WooCommerce products across Gutenberg, Elementor, Divi, and Beaver Builder. Versions up to and including 3.9.1 are affected through the register_rest_routes function. Authenticated attackers with subscriber-level access or higher can extract admin-authored editor content. Exposed data includes template markup, CSS code, JavaScript code, and PHP controller variables for any Layout or Post Selection post. The root weakness maps to [CWE-862] Missing Authorization.
Critical Impact
Any authenticated user, including low-privilege subscribers, can read admin-authored template, CSS, JavaScript, and PHP controller content stored in Layout and Post Selection posts.
Affected Products
- Advanced Views – Display Custom Fields (ACF, Pods, MetaBox), Posts, CPT and Woo Products plugin for WordPress
- All plugin versions up to and including 3.9.1
- WordPress sites accepting subscriber-level or higher registrations
Discovery Timeline
- 2026-08-01 - CVE-2026-17580 published to NVD
- 2026-08-03 - Last updated in NVD database
Technical Details for CVE-2026-17580
Vulnerability Analysis
The vulnerability resides in the register_rest_routes implementation across several Interactive_Fields classes within the plugin. The affected files include Cpt_Interactive_Fields.php, Layout_Interactive_Fields.php, and Selection_Interactive_Fields.php. These REST endpoints register handlers that return editor-side content for Layout and Post Selection custom post types. The endpoints fail to enforce an appropriate capability check for the type of data they return. Any authenticated session, including subscribers, satisfies the permission callback and receives the response payload.
The returned payload includes template markup, CSS, JavaScript, and PHP controller variables authored by administrators. This content is not intended for public or low-privilege consumption. Attackers can enumerate Layout and Post Selection post IDs and harvest configuration used to build front-end views. See the Wordfence Vulnerability Report for the full analysis.
Root Cause
The root cause is missing authorization on REST routes registered by the plugin. The permission callbacks check that a user is authenticated but do not restrict access to editors or administrators. As a result, the routes treat subscriber sessions as trusted callers. The specific handlers appear at line 77 and line 98 of Cpt_Interactive_Fields.php, line 74 of Layout_Interactive_Fields.php, and line 30 of Selection_Interactive_Fields.php.
Attack Vector
An attacker obtains subscriber-level credentials on a target WordPress site. The attacker then sends authenticated HTTP requests to the plugin's REST routes for Layout or Post Selection resources. The server returns the requested editor content without enforcing a capability check. The attacker iterates over post IDs to collect all admin-authored template, CSS, JavaScript, and PHP controller variables. Refer to the plugin changeset for the specific handler code paths.
Detection Methods for CVE-2026-17580
Indicators of Compromise
- Authenticated REST API requests from subscriber accounts to /wp-json/ routes registered by the acf-views plugin.
- High-volume enumeration of Layout or Post Selection post IDs from a single low-privilege session.
- Unexpected outbound transfer of template, CSS, JavaScript, or PHP controller content in REST responses.
Detection Strategies
- Correlate WordPress access logs with user roles and flag subscribers issuing repeated calls to plugin REST endpoints.
- Alert on new or infrequently used subscriber accounts that begin querying admin-authored resources shortly after registration.
- Baseline expected REST traffic for the acf-views namespace and alert on deviations in request volume or response size.
Monitoring Recommendations
- Enable WordPress REST API request logging with user ID, route, and response size fields.
- Monitor subscriber account creation rates on sites where open registration is enabled.
- Track plugin versions across all WordPress installations to identify hosts still running 3.9.1 or earlier.
How to Mitigate CVE-2026-17580
Immediate Actions Required
- Update the Advanced Views plugin to a version later than 3.9.1 that enforces capability checks on the affected REST routes.
- Audit existing subscriber accounts and remove accounts that show no legitimate activity.
- Review Layout and Post Selection posts for sensitive data such as credentials or internal URLs embedded in template or PHP controller content.
Patch Information
The vendor released a fix after version 3.9.1. Review the plugin changeset and upgrade to the latest available release. Validate that the register_rest_routes permission callbacks now require an editor or administrator capability such as edit_posts or higher.
Workarounds
- Disable open user registration in WordPress settings until the plugin is upgraded.
- Deactivate the Advanced Views plugin on sites that cannot immediately apply the update.
- Restrict access to /wp-json/ REST endpoints associated with the plugin at the web application firewall or reverse proxy layer.
- Rotate any secrets that may have been embedded in admin-authored Layout, CSS, JavaScript, or PHP controller content.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
