Vulnerabilities / Advanced Custom Fields: Extended / WPSEC-2026-1280
Advanced Custom Fields: Extended <= 0.9.2.7 - Unauthenticated Arbitrary Attachment Deletion via Form Email Action
Medium 4.8
CWE-862Fixed in 0.9.2.8
- ID
- WPSEC-2026-1280
- Plugin
- Advanced Custom Fields: Extended (acf-extended)
- Affected
- all versions before 0.9.2.8
- Remediation
- Update to 0.9.2.8 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
- Weakness
- CWE-862
- Usage
- Plugin Medium · Affected versions Low among sites WPSec scans, 2026-10-21
- Attack surface
- Advanced Custom Fields: Extended on WPSec AttackSurface
- Fix released
- Published
Description
The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to unauthorized attachment deletion via the form 'Email' action's 'Delete attachment' option in all versions up to, and including, 0.9.2.7. This is due to the delete_post capability check only running when the submitted attachment value is numeric. This makes it possible for unauthenticated attackers to delete arbitrary media attachments by submitting an attachment URL instead of an ID, on forms that have an Email action with file deletion turned on.
References
- https://wpsec.com/vuln/WPSEC-2026-1280/
- https://plugins.svn.wordpress.org/acf-extended/tags/0.9.2.8/
- https://wordpress.org/plugins/acf-extended/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS