{
 "id": "WPSEC-2026-1280",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1280/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1280/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1280/index.md",
 "title": "Advanced Custom Fields: Extended <= 0.9.2.7 - Unauthenticated Arbitrary Attachment Deletion via Form Email Action",
 "description": "The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to unauthorized attachment deletion via the form 'Email' action's 'Delete attachment' option in all versions up to, and including, 0.9.2.7. This is due to the delete_post capability check only running when the submitted attachment value is numeric. This makes it possible for unauthenticated attackers to delete arbitrary media attachments by submitting an attachment URL instead of an ID, on forms that have an Email action with file deletion turned on.",
 "plugin": {
  "slug": "acf-extended",
  "name": "Advanced Custom Fields: Extended",
  "full_name": "Advanced Custom Fields: Extended",
  "wordpress_org": "https://wordpress.org/plugins/acf-extended/",
  "advisories_url": "https://wpsec.com/vuln/plugin/acf-extended/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/acf-extended"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.8,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "0.9.2.8",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 0.9.2.8"
  ]
 },
 "introduced_in": null,
 "fixed_in": "0.9.2.8",
 "remediation": "Update to 0.9.2.8 or later.",
 "fix_released": "2026-10-19T13:23:29+00:00",
 "published": "2026-10-21T10:43:36+00:00",
 "updated": "2026-10-21T10:34:09.721780+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1280/",
  "https://plugins.svn.wordpress.org/acf-extended/tags/0.9.2.8/",
  "https://wordpress.org/plugins/acf-extended/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/acf-extended",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Low",
  "as_of": "2026-10-21"
 }
}