Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The Advanced Members for ACF plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the create_crop function in all versions up to, and including, 1.2.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The vulnerability was partially patched in version 1.2.5.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-04-08 | 1 | Disclosure1 |
| 2026-04-12 | 1 | General1 |
CVE-2026-3243 The Advanced Members for ACF plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the create_crop function in all v… https://www.cve.org/CVERecord?id=CVE-2026-3243
Post summary
A brief note about a file deletion flaw in the Advanced Members for ACF WordPress plugin; no PoC, exploit, or patch details are presented.
[CVE-2026-3243: HIGH] WordPress ACF plugin vulnerability enables attackers to delete files on the server via insufficient file path validation in create_crop function. Patch available in version 1.2.5.#cve,CVE-2026-3243,#cybersecurity https://cvefind.com/CVE-2026-3243
Post summary
CVE-2026-3243 is a high‑severity issue in the WordPress ACF plugin that allows file deletion through insufficient path validation; a patch is available in version 1.2.5.