Security Alert Summary
The Advanced Custom Fields: Extended plugin for WordPress contains an authorization bypass vulnerability that can allow unauthenticated attackers to permanently delete arbitrary media library attachments when a site administrator has configured a specific public-facing ACFE form. The issue stems from the plugin failing to verify that a user is authorized to perform attachment deletion before processing a form submission.
CVE Details
- CVE ID:
CVE-2026-10752 - Affected component: Advanced Custom Fields: Extended plugin for WordPress
- Affected versions: All versions up to and including 0.9.2.6
- Published: October 27, 2026 at 12:17:04 PM (UTC)
- Last modified: October 27, 2026 at 2:52:13 PM (UTC)
- CVSS v3.1: Base score 4.8 (MEDIUM) —
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L - Attack vector: Network
- Attack complexity: High
- Privileges required: None
- User interaction: None
- Scope: Unchanged
- Primary impact: Integrity: Low; Availability: Low; Confidentiality: None
- Weakness: CWE-862 (Missing Authorization)
Technical Details
The vulnerability is an authorization bypass: the plugin does not properly verify that the submitting user is authorized to delete a given media attachment. An attacker can submit a numeric attachment ID in the form data and trigger deletion without any ownership or capability checks.
The issue is tied to ACFE form processing when an Email action is configured for a public-facing form and that action includes an attachment row whose source is a dynamic {field:...} bound to a submittable field with the Delete option enabled. The referenced implementation path points to the plugin form action code (see includes/modules/form/module-form-action-email.php in the plugin source) where deletion is performed without sufficient authorization checks.
Impact is limited to permanent removal of media library attachments. The flaw does not, based on the provided data, disclose media contents or escalate to account takeover on its own. Exploitation requires the specific form and Email action configuration described above.
How This Could Impact Your Website
Consider a small organization where a site owner or administrator publishes public submission forms to collect files from external contributors or staff. If an administrator configures an ACFE form with an Email action that includes a dynamically-sourced attachment field and enables the Delete option, an unauthenticated attacker could submit crafted form data containing numeric attachment IDs and cause attachments owned by any user to be permanently deleted.
Realistic consequences include loss of important media (product images, marketing assets, or contributor uploads), disruption to content publishing, and the need to restore media from backups. While this vulnerability does not directly expose confidential content according to the CVSS data, deleted attachments could increase operational work and create opportunities for targeted social engineering if contact or asset records are disturbed.
If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review of your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor-level accounts and other roles with upload capabilities.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins that increase attack surface.
- Monitor site activity and media library changes for unusual behavior and maintain recent backups of media and site content.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/acf-extended/tags/0.9.2.3/includes/modules/form/module-form-action-email.php#L149
- https://plugins.trac.wordpress.org/browser/acf-extended/tags/0.9.2.3/includes/modules/form/module-form-action-email.php#L178
- https://plugins.trac.wordpress.org/changeset/3667996/acf-extended
- https://www.wordfence.com/threat-intel/vulnerabilities/id/ed7f3f80-4d08-440f-b990-b1099a565ed0?source=cve
