CVE-2026-3243
HighCVSS 8.8Exploitation Probability (EPSS)
Elevated risk53th percentile - higher than 53% of all known CVEs
Summary
The Advanced Members for ACF plugin for WordPress up to version 1.2.5 inclusive contains an arbitrary file deletion vulnerability due to insufficient file path validation in the create_crop function. An authenticated attacker with Subscriber-level access or higher can delete arbitrary files on the server, which can lead to remote code execution after deleting a critical file such as wp-config.php.
Risk Assessment
The risk for the organization is high, as an attacker can delete critical configuration files, potentially leading to full compromise of the WordPress server.
Recommendation
It is recommended to immediately update the Advanced Members for ACF plugin to the latest available version that contains the full patch.
Other vulnerabilities in Advanced Members for ACF
Original NVD description (English source)
The Advanced Members for ACF plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the create_crop function in all versions up to, and including, 1.2.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The vulnerability was partially patched in version 1.2.5.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS