Log in Start free

Vulnerability · Published Aug 1, 2026 · Assigned by Wordfence

CVE-2026-17580Advanced Views <= 3.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via 'view-refresh' and 'card-refresh' REST Endpoints

Medium 6.5

In plain English

A medium-severity missing authorization in Advanced Views – Display Custom Fields (ACF, Pods, MetaBox), Posts, CPT and Woo Products anywhere in Gutenberg, Elementor, Divi, Beaver… from wplakeorg. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 46% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.6%top 53.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

The Advanced Views – Display Custom Fields (ACF, Pods, MetaBox), Posts, CPT and Woo Products anywhere in Gutenberg, Elementor, Divi, Beaver… plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.9.1 via the register_rest_routes. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract sensitive admin-authored editor content — including template markup, CSS code, JavaScript code, and PHP controller variables — for any Layout or Post Selection post on the site.

Affected products (as reported)

VendorProductVersions
wplakeorg Advanced Views – Display Custom Fields (ACF, Pods, MetaBox), Posts, CPT and Woo Products anywhere in Gutenberg, Elementor, Divi, Beaver… 0 – through 3.9.1

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References