# Unauthenticated disclosure of draft/private/pending post titles & IDs via Secure Custom Fields nopriv AJAX field-query handlers (post_object/relations

Unauthenticated nopriv AJAX handlers in Secure Custom Fields leak draft/private/pending post titles and IDs via reusable anonymous nonce scraped from public acf_form pages.

- Payout: hidden
- Severity: medium
- Program: WordPress
- Found by: jakubk
- Disclosed: 2026-09-28
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/3893632
- Library page: https://bugbountylibrary.com/r/h1%3A3893632
- Tags: area:web domain:web impact:data-leak kind:bounty platform:hackerone sev:medium tech:php tech:wordpress technique:recon technique:source-review vuln:access-control vuln:info-disclosure

**Target:** WordPress plugin AJAX field-query handlers (post_object/relationship/page_link)
**Root cause:** wp_ajax_nopriv_ handlers run WP_Query with post_status defaulting to 'any' and no capability/perm check; the only gate is a per-field nonce that is shared across all anonymous visitors (uid 0).
**Steps:**
1. Register a post_object field with no post_status restriction, render via acf_form() on a public page.
2. Create DRAFT 'SECRET-DRAFT' and PRIVATE 'PRIVATE-POST'.
3. Scrape nonce: `curl -s https://SITE/pubform/ | grep -o 'data-nonce="[a-f0-9]*"'`.
4. POST `action=acf/fields/post_object/query&field_key=<key>&nonce=<nonce>&paged=1` to admin-ajax.php -> returns private/draft posts.
5. Targeted search: add `&s=SECRET` to enumerate specific titles.
**How found:** Code review of the field classes spotted wp_ajax_nopriv_ registration and traced ajax_query -> get_ajax_query -> acf_get_grouped_posts, noticing post_status defaults to 'any' with no perm check, and that the nonce gate is emitted publicly and shared among anonymous users.
**Exploitation:** Unauthenticated attacker fetches any public page rendering the field, extracts the anonymous nonce from HTML, and replays it against the nopriv AJAX endpoint to enumerate non-public post titles/IDs, optionally keyword-filtered via `s`.
**Insight:** Anonymous WordPress nonces (uid 0, empty session token) are identical for all logged-out visitors, so any nonce leaked into public HTML is effectively a universal key — check nopriv AJAX handlers that gate only on such nonces and pass user-controlled query args to WP_Query.