CVE-2026-3243 - Vulnerability Analysis

Overview

Advanced Members for ACF WordPress plugin <= 1.2.5 contains an arbitrary file deletion vulnerability caused by insufficient file path validation in create_crop function, letting authenticated attackers with Subscriber-level access delete arbitrary files, exploit requires Subscriber-level or higher access.

Severity & Score

Impact

Authenticated attackers can delete arbitrary files, potentially leading to remote code execution and full server compromise.

Mitigation

Update to a version later than 1.2.5 or the latest available version.

References

• https://plugins.trac.wordpress.org/browser/advanced-members/tags/1.2.4/core/modules/class-avatar.php#L266
• https://plugins.trac.wordpress.org/browser/advanced-members/tags/1.2.4/core/modules/class-avatar.php#L57
• https://plugins.trac.wordpress.org/browser/advanced-members/trunk/core/modules/class-avatar.php#L710
• https://plugins.trac.wordpress.org/changeset/3479725/
• https://plugins.trac.wordpress.org/changeset/3492372/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/22b63369-c6ea-42e9-bea3-d15837da7732?source=cve

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner