Advanced Members for ACF <= 1.2.5 - Authenticated (Subscriber+) Willkürliches Löschen von Dateien über Pfadübersprung

The primary impact of CVE-2026-3243 is the ability for an authenticated attacker to delete files on the WordPress server. Because the vulnerability requires only Subscriber-level access, the attack surface is relatively broad. A successful attack could involve deleting critical configuration files like wp-config.php, leading to complete site compromise and remote code execution. Deletion of other sensitive files could expose database credentials or other confidential information. The potential for RCE significantly elevates the risk, as it allows an attacker to gain full control of the affected WordPress instance.

WordPress websites utilizing the Advanced Members for ACF plugin, particularly those running older versions (≤1.2.5) and those with Subscriber-level users or higher who have access to plugin functionality. Shared hosting environments where file permissions are not tightly controlled are also at increased risk.

• wordpress / plugin:

wp plugin list

Check if the Advanced Members for ACF plugin is installed and its version. If the version is ≤1.2.5, the system is vulnerable. • wordpress / plugin:

wp plugin update advanced-members-for-acf

Attempt to update the plugin to the latest version (1.2.6 or later). • wordpress / file system: Inspect the WordPress file system for any unusual files or modifications, particularly in directories accessible to the WordPress user. • wordpress / plugin: Review the plugin's code for any instances of file path manipulation or validation that could be exploited.

1. 2026-04-07Disclosure

   disclosure

1. Reserviert2026-02-26
2. Veröffentlicht2026-04-07
3. Geändert2026-04-08
4. EPSS aktualisiert2026-04-15

The primary mitigation for CVE-2026-3243 is to immediately upgrade the Advanced Members for ACF plugin to version 1.2.6 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider restricting file permissions on the WordPress server to limit the attacker’s ability to delete files. Implement a Web Application Firewall (WAF) with rules to block requests containing suspicious file paths or patterns. Monitor WordPress logs for unusual file deletion activity. After upgrading, confirm the fix by attempting a file deletion request through the plugin's interface with a crafted path; the request should be rejected.

Aktive Installationen

30Nische

Plugin-Bewertung