CVE-2026-112311
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
The ACF Extended plugin through 0.9.2.7 contains a Path Traversal vulnerability due to improper limitation of a pathname to a restricted directory. This may allow an attacker to access files outside the intended directory.
Risk Assessment
An attacker may gain access to sensitive files on the system, potentially leading to information disclosure or further escalation. This can compromise the confidentiality of site data.
Recommendation
Update the ACF Extended plugin to a version later than 0.9.2.7 if available. Until then, consider restricting access to the plugin and monitoring for unusual requests.
Other vulnerabilities in ACF Extended
See all- CVE-2026-112313High
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ACF Extended acf-extended allows Stored XSS. This issue affects ACF Extended: from n/a through 0.9.2.7.
- CVE-2026-112312High
The ACF Extended WordPress plugin (versions through 0.9.2.7) contains a missing authorization vulnerability due to incorrectly configured access control security levels. This may allow exploitation of improperly configured access controls.
- CVE-2026-81284Medium
The ACF Extended plugin in versions 0.9.2.6 and earlier has a Broken Access Control vulnerability for contributors. Contributor-level users can gain unauthorized access to administrative functions.
Original NVD description (English source)
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ACF Extended ACF Extended acf-extended allows Path Traversal.This issue affects ACF Extended: from n/a through 0.9.2.7.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS