Path Traversal Vulnerability in ACF Extended Plugin by ACF Extended

CVE-2026-112311

What is CVE-2026-112311?

The ACF Extended plugin for WordPress is susceptible to a path traversal vulnerability that could allow unauthorized access to filesystem paths outside the intended directory. This flaw affects versions ranging up to 0.9.2.7, potentially allowing attackers to manipulate file paths and perform actions like arbitrary file deletion, thereby compromising the integrity and security of the affected website. It’s crucial for users of the plugin to apply security patches and updates promptly to mitigate the risk posed by this vulnerability.

References