CVE-2026-3243

CVE-2026-3243 affects the Advanced Members for ACF plugin for WordPress in versions up to 1.2.5, where insufficient file path validation in the create_crop function allows arbitrary file deletion on affected servers. Authenticated attackers with Subscriber-level access or higher can exploit this vulnerability to remove critical files, potentially enabling remote code execution through deletion of sensitive configuration files such as wp-config.php. The vulnerability was only partially addressed in version 1.2.5, indicating continued risk for unpatched installations. The vulnerability presents a high-severity threat with a CVSS score of 8.8, accessible over the network with low attack complexity and requiring only low-level user authentication. The attack requires no user interaction and can completely compromise the confidentiality, integrity, and availability of affected systems. The EPSS score of 0.00222 suggests minimal empirical exploitation probability at this time, though this remains a significant risk given the ease of weaponization. As of the current assessment, CVE-2026-3243 is not listed on the Known Exploited Vulnerabilities catalog and shows no evidence of active exploitation in the wild. The vulnerability maintains an inactive status on security community hot lists and does not appear to have publicly available exploit code widely circulated. Organizations running affected versions should prioritize upgrading beyond version 1.2.5 to mitigate this risk despite the low current exploitation activity.