CVE-2026-112311: WordPress ACF Extended plugin <= 0.9.2.7 - Arbitrary File Deletion vulnerability

Q: What level of access does an attacker need?

The vulnerability is remotely exploitable over the network, has low attack complexity, and does not require privileges or user interaction.

Q: Which installations should be reviewed?

ACF Extended versions through 0.9.2.7 are affected. The available data does not identify a fixed version.

Published Oct 22, 2026

Updated

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ACF Extended ACF Extended acf-extended allows Path Traversal.This issue affects ACF Extended: from n/a through 0.9.2.7.

Affected Software

1 affected component

ACF Extended ACF Extended<=0.9.2.7

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress ACF Extended plugin to a version that resolves this vulnerability.
Fixed in 0.9.2.8

Event History

Oct 22, 2026

CVE Published

via MITRE·08:00 AM

Data Sourced

via MITRE·08:00 AM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

What level of access does an attacker need?

The vulnerability is remotely exploitable over the network, has low attack complexity, and does not require privileges or user interaction.

Which installations should be reviewed?