CVE-2026-3243: Path Traversal in Advanced Members for ACF

The core impact of CVE-2026-3243 lies in the ability for an authenticated attacker (Subscriber level or higher) to delete files on the WordPress server. While the vulnerability is classified as a Path Traversal, the potential for remote code execution is significant. Deleting the wp-config.php file, for example, would effectively disable the WordPress installation, and depending on the server configuration, could allow an attacker to upload and execute malicious code. This could lead to complete server compromise, data theft, and denial of service. The partial patch in 1.2.5 suggests that initial attempts to address the vulnerability were made, but a complete fix was necessary.

1. Reserved2026-02-26
2. Published2026-04-07
3. Modified2026-04-08
4. EPSS updated2026-04-15

The primary mitigation for CVE-2026-3243 is to immediately upgrade the Advanced Members for ACF plugin to version 1.2.6 or later. If upgrading is not immediately feasible due to compatibility concerns or breaking changes, consider restricting file permissions on the WordPress server to limit the impact of a successful attack. While not a complete solution, implementing a Web Application Firewall (WAF) with rules to block suspicious file deletion attempts can provide an additional layer of defense. Regularly review WordPress file permissions and user roles to ensure the principle of least privilege is enforced.

Active installs

30Niche

Plugin rating