CVE-2026-17580 describes a missing authorization vulnerability in the Advanced Views – Display Custom Fields (ACF, Pods, MetaBox), Posts, CPT and Woo Products anywhere in Gutenberg, Elementor, Divi, Beaver… WordPress plugin. Authenticated users with subscriber-level privileges or above can exploit this flaw through the register_rest_routes REST API endpoint to retrieve sensitive content authored by administrators, including template markup, CSS, JavaScript, and PHP controller variables for any Layout or Post Selection post on the affected site. This vulnerability affects all plugin versions up to and including 3.9.1.

The vulnerability allows unauthorized disclosure of sensitive administrative content to authenticated users with low privileges (subscriber-level and above). This exposure can lead to leakage of template code, styling, scripts, and PHP variables, potentially aiding further attacks or information gathering. There is no indication of impact on integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch links are provided, users should monitor the vendor's communications for updates. Until a fix is available, restrict subscriber-level access where possible and consider disabling the plugin if sensitive information exposure risk is unacceptable.