Threats tagged 'ghsa-6687-wfp7-4mp6'

The Advanced Custom Fields: Extended plugin for WordPress versions up to 0.9.2.7 contains multiple AJAX handlers accessible to unauthenticated users that lack proper authorization checks. These handlers expose cryptographic nonces generated for guest users, which are publicly visible on frontend pages using ACF forms. This allows attackers to bypass WordPress visibility permissions and access unauthorized data such as post titles and internal layout structures. A partial patch was introduced in version 0.9.2.4.