An arbitrary file deletion vulnerability in the Advanced Custom Fields: Extended plugin for WordPress allows unauthenticated attackers to delete arbitrary…
Affected component: Advanced Custom Fields: Extended (plugin)
Fixed in: 0.9.2.8
PowerSEC coverage: PowerSEC detects the affected versions on every plan, and has since October 30, 2026. No PowerSEC firewall rule blocks this attack. Update to 0.9.2.8 or later to remove the vulnerability.
Full advisory, including detection steps and remediation: https://powersec.io/vulnerability/cve-2026-112311