CVE-2026-10752mediumCWE-862

CVE-2026-10752: falha de média gravidade em hwk-fr Advanced Custom Fields: Extended

Advanced Custom Fields: Extended <= 0.9.2.6 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via Email Action Dynamic File Field

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Advanced Custom Fields: Extended

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 4.8epss 0.3%
The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 0.9.2.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to permanently delete arbitrary WordPress media library attachments by supplying a numeric attachment ID in the form submission without any ownership or capability verification. Exploitation requires a site administrator to have configured a public-facing ACFE form with an Email action whose attachment row uses a dynamic {field:...} source bound to a submittable field with the Delete option enabled.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
Produtos afetados
hwk-fr · Advanced Custom Fields: Extended
CVEs relacionadas — hwk-fr Advanced Custom Fields: Extended

No mesmo produto, das mais perigosas para as menos.

CVE-2025-13486CRITICALAdvanced Custom Fields: Extended 0.9.0.5 - 0.9.1.1 - Unauthenticated Remote Code Execution in prepare_formEPSS 68.6%CVE-2025-14533CRITICALAdvanced Custom Fields: Extended <= 0.9.2.1 - Unauthenticated Privilege Escalation via Insert User Form ActionEPSS 1.5%CVE-2026-8809CRITICALAdvanced Custom Fields: Extended <= 0.9.2.5 - Unauthenticated Privilege Escalation via Validation Bypass to '_acf_post_id' ParameterEPSS 0.8%CVE-2026-110305HIGHAdvanced Custom Fields: Extended <= 0.9.2.7 - Unauthenticated Sensitive Information Exposure in 'acf[<mapped_field>]' Parameter via {get_user} Template Tag InjectionEPSS 0.6%CVE-2023-5292MEDIUMAdvanced Custom Fields: Extended <= 0.8.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.4%CVE-2025-15463MEDIUMAdvanced Custom Fields: Extended <= 0.9.2.3 - Unauthenticated Arbitrary Shortcode ExecutionEPSS 0.4%