Live › vulnerability › CVE-2026-10752
Go to dashboardThe Advanced Custom Fields: Extended plugin for WordPress up to and including 0.9.2.6 does not check authorization when a form submits an attachment ID. An unauthenticated attacker can permanently delete arbitrary media library attachments.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 12:31 UTC. All times on this page are UTC.
Sites running Advanced Custom Fields: Extended at version 0.9.2.6 or earlier that have a public-facing ACFE form with an Email action whose attachment row uses a dynamic {field:...} source bound to a submittable field with Delete enabled. Sites without such a form configuration are not exposed through this path, and sites without public forms can skip it.
No product ranges from the sources yet.
wp plugin get acf-extended --field=version0.9.2.6 once a patched release is published (unknown from the sources)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 0.9.2.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to permanently delete arbitrary WordPress media library attachments by supplying a numeric attachment ID in the form submission without any ownership or capability verification. Exploitation requires a site administrator to have configured a public-facing ACFE form with an Email action whose attachment row uses a dynamic {field:...} source bound to a submittable field with the Delete option enabled.
This page as .md · .json · in your agent: get_signal("CVE-2026-10752")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.