CVE-2026-10752: Advanced Custom Fields: Extended <= 0.9.2.6 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via Email Action Dynamic File Field
The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 0.9.2.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to permanently delete arbitrary WordPress media library attachments by supplying a numeric attachment ID in the form submission without any ownership or capability verification. Exploitation requires a site administrator to have configured a public-facing ACFE form with an Email action whose attachment row uses a dynamic {field:...} source bound to a submittable field with the Delete option enabled.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable the Delete option for the submittable field used as the dynamic {field:...} attachment source in the Email action.
Advanced Custom Fields: Extended Delete option = disabled
Event History
Frequently Asked Questions
Which sites are exposed to this issue?
A site is exposed only if it uses Advanced Custom Fields: Extended version 0.9.2.6 or earlier and an administrator has configured a public-facing ACFE form with an Email action. The Email action must include an attachment row using a dynamic {field:...} source tied to a field that visitors can submit, with the Delete option enabled.
Does an attacker need an account or permissions?
No. An unauthenticated attacker can exploit the issue if the required public form configuration exists. They can submit a numeric WordPress attachment ID without needing ownership of that attachment or the capability to delete it.
What is the practical impact of successful exploitation?
An attacker can permanently delete arbitrary attachments from the WordPress media library. The stated impact is limited to integrity and availability; no confidentiality impact is identified.
How can I determine whether the vulnerable configuration is present?
Review public-facing ACFE forms for Email actions with attachment rows sourced dynamically through {field:...}. Check whether the referenced field is submittable by visitors and whether Delete is enabled for that attachment handling.