Authorization Bypass in Advanced Custom Fields: Extended Plugin for WordPress

CVE-2026-10752

What is CVE-2026-10752?

The Advanced Custom Fields: Extended plugin for WordPress contains a vulnerability related to authorization bypass, allowing unauthorized users to delete any media library attachments without proper verification. In all versions up to and including 0.9.2.6, an attacker can exploit this flaw by submitting a numeric attachment ID through a public-facing form that is configured to allow deletions. This exploitation requires a configuration where an Email action is set up using a dynamic source tied to fields that permit deletion, posing significant risk to media integrity on compromised sites.

References