Arbitrary File Deletion Vulnerability in Advanced Members for ACF Plugin by WordPress

CVE-2026-3243

What is CVE-2026-3243?

The Advanced Members for ACF plugin presents a critical security issue due to flawed file path validation in its create_crop function, affecting all versions up to and including 1.2.5. This vulnerability enables authenticated users with Subscriber-level privileges and above to delete arbitrary files on the server. Such actions can have severe consequences, including the potential for remote code execution, particularly if essential files like wp-config.php are targeted. A partial patch was introduced in version 1.2.5 yet highlights the need for users to act promptly in securing their installations.

References