Executive brief
Advanced Views is a WordPress plugin used to display content from Advanced Custom Fields. A security flaw allows users with basic 'Subscriber' accounts to execute unauthorized code on the web server. This could lead to a complete takeover of the website, theft of customer data, or the installation of persistent backdoors.
Technical details
The Advanced Views plugin (versions 3.8.11 and earlier) for WordPress contains a code injection vulnerability (CWE-94) that leads to Remote Code Execution (RCE). The flaw allows an authenticated attacker with low-level 'Subscriber' privileges to inject and execute arbitrary PHP code on the server. This is achieved through improper control of code generation within the plugin's components. The vulnerability has a CVSS score of 9.9 due to the potential for full system compromise and the ability to bypass security boundaries (Scope: Changed). A fix is available in version 3.9.0.
Affected products
- WPLake Advanced Views <= 3.8.11
Timeline
- 2026-06-23: other: Vulnerability reported by researcher Nguyen Ba Khanh
- 2026-07-22: advisory: Patchstack published security advisory
- 2026-07-23: disclosed: CVE published to NVD dataset
- 2026-07-23: patched: Version 3.9.0 released to address the vulnerability