# Advanced Custom Fields: Extended <= 0.9.2.7 - Unauthenticated Arbitrary Attachment Deletion via Form Email Action

- **ID:** WPSEC-2026-1280
- **Plugin:** Advanced Custom Fields: Extended (`acf-extended`), https://wordpress.org/plugins/acf-extended/
- **Affected versions:** all versions before 0.9.2.8
- **Fixed in:** 0.9.2.8 (Update to 0.9.2.8 or later.)
- **Severity:** Medium 4.8 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Medium, affected versions Low (as of 2026-10-21)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/acf-extended
- **Fix released:** 2026-10-19
- **Published:** 2026-10-21
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1280/

## Description

The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to unauthorized attachment deletion via the form 'Email' action's 'Delete attachment' option in all versions up to, and including, 0.9.2.7. This is due to the delete_post capability check only running when the submitted attachment value is numeric. This makes it possible for unauthenticated attackers to delete arbitrary media attachments by submitting an attachment URL instead of an ID, on forms that have an Email action with file deletion turned on.

## References

- https://wpsec.com/vuln/WPSEC-2026-1280/
- https://plugins.svn.wordpress.org/acf-extended/tags/0.9.2.8/
- https://wordpress.org/plugins/acf-extended/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1280/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.