🔐 CVE Alert

CVE-2026-3243

HIGH 8.8

Advanced Members for ACF <= 1.2.5 - Authenticated (Subscriber+) Arbitrary File Deletion via Path Traversal

CVSS Score
8.8
EPSS Score
0.0%
EPSS Percentile
0th

The Advanced Members for ACF plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the create_crop function in all versions up to, and including, 1.2.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The vulnerability was partially patched in version 1.2.5.

CWE CWE-22
Vendor danbilabs
Product advanced members for acf
Published Apr 8, 2026
Last Updated Apr 8, 2026
Stay Ahead of the Next One

Get instant alerts for danbilabs advanced members for acf

Be the first to know when new high vulnerabilities affecting danbilabs advanced members for acf are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability

Affected Versions

danbilabs / Advanced Members for ACF
0 ≤ 1.2.5

References

NVD ↗ CVE.org ↗ EPSS Data ↗
wordfence.com: https://www.wordfence.com/threat-intel/vulnerabilities/id/22b63369-c6ea-42e9-bea3-d15837da7732?source=cve plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/advanced-members/tags/1.2.4/core/modules/class-avatar.php#L57 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/advanced-members/tags/1.2.4/core/modules/class-avatar.php#L266 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/advanced-members/trunk/core/modules/class-avatar.php#L710 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/changeset/3479725/ plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/changeset/3492372/

Credits

Muhammad Yudha - DJ