PT-2026-31295 · WordPress · Advanced Members For Acf

Published 2026-04-08 · Updated 2026-04-12 · CVE-2026-3243

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Advanced Members for ACF plugin for WordPress versions up to and including 1.2.5

Description The Advanced Members for ACF plugin for WordPress has a flaw that allows authenticated attackers with Subscriber-level access or higher to delete arbitrary files on the server. This is due to inadequate file path validation within the create crop function. Deleting specific files, such as wp-config.php, could lead to remote code execution.

Recommendations Update to a version later than 1.2.5.

Fix

RCE

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-3243

Affected Products

Advanced Members For Acf

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2026-3243 · Security Note
• https://plugins.trac.wordpress.org/browser/advanced-members/trunk/core/modules/class-avatar.php#L710 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/22b63369-c6ea-42e9-bea3-d15837da7732?source=cve · Note
• https://plugins.trac.wordpress.org/changeset/3492372 · Note
• https://plugins.trac.wordpress.org/browser/advanced-members/tags/1.2.4/core/modules/class-avatar.php#L266 · Note
• https://plugins.trac.wordpress.org/browser/advanced-members/tags/1.2.4/core/modules/class-avatar.php#L57 · Note
• https://plugins.trac.wordpress.org/changeset/3479725 · Note
• https://t.me/CVEtracker/50051 · Telegram Post
• https://twitter.com/CveFindCom/status/2041859389485666608 · Twitter Post
• https://twitter.com/CVEnew/status/2043295672233812159 · Twitter Post