What the vulnerability does
01Description
The Advanced Views – Display Custom Fields (ACF, Pods, MetaBox), Posts, CPT and Woo Products anywhere in Gutenberg, Elementor, Divi, Beaver… plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.9.1 via the register_rest_routes. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract sensitive admin-authored editor content — including template markup, CSS code, JavaScript code, and PHP controller variables — for any Layout or Post Selection post on the site.
Explanation of Vulnerability in Simple Terms
02Summary
The Advanced Views plugin for WordPress contains an authorization flaw that allows authenticated users with low privileges to read sensitive data they should not access. The vulnerability affects all versions up to 3.9.1. An attacker with a basic user account can retrieve confidential information by exploiting missing permission checks in the plugin's data retrieval functions.
What an attacker can do
03Attacker Capabilities
Read sensitive data and custom fields they don't have permission to access.
Potential impact on your site
04Site Impact
Private custom field data, ACF fields, and post metadata may be exposed to low-privilege users.
Conditions required to exploit
05Prerequisites
Attacker must have a low-privilege WordPress user account (e.g., subscriber or contributor).
Key dates
06Disclosure timeline
August 1, 2026
CVE published
August 3, 2026
Record updated
