File Deletion Vulnerability in Tassos Framework Plugin by Tassos
CVE-2026-48906

9.3CRITICAL

Key Information:

Vendor

Tassos.gr

Status
Novarain/tassos Framework (plg System Nrframework)
Convert Forms
Engagebox
Google Structured Data
Vendor
CVE Published:
27 May 2026

What is CVE-2026-48906?

The Tassos Framework Plugin has a vulnerability that permits unauthorized users to delete arbitrary files from affected websites. This could potentially lead to data loss or unauthorized access, compromising the integrity of the site. Website administrators are urged to review their plugin versions and apply necessary security measures to protect their systems from exploitation.

Affected Version(s)

Advanced Custom Fields 1.0.0-2.8.12

Advanced Custom Fields 3.0.0-3.1.3

Convert Forms 1.0.0-4.4.12

References

https://tassos.gr
product

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
None
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Leandro Vallim
.