CVE-2026-112311 in Advanced Custom Fields: Extended

Summary

An arbitrary file deletion vulnerability exists in the Advanced Custom Fields: Extended plugin for WordPress. This affects all plugin versions up to and including 0.9.2.7. A patch is available in version 0.9.2.8. There is no evidence of active exploitation for this vulnerability.

Affected and patched versions

• Advanced Custom Fields: Extended (plugin acf-extended): affected 0.9.2.7 and earlier; fixed in 0.9.2.8

Is my site vulnerable?

To determine if your WordPress site uses a vulnerable version of the Advanced Custom Fields: Extended plugin, you need to check the installed version. This can be done through the WordPress administration dashboard or via the command line using WP-CLI.

Checking via WordPress Administration Dashboard:

1. Log in to your WordPress administration area.

2. Navigate to the "Plugins" section from the left-hand menu.

3. Locate "Advanced Custom Fields: Extended" in the list of installed plugins.

4. The version number is displayed next to the plugin name.

If the displayed version is 0.9.2.7 or any earlier release, your site uses a vulnerable version of the plugin. Version 0.9.2.8 or later contains the necessary security fixes.

Checking via WP-CLI (if you have command-line access to your server):

1. Connect to your server via SSH.

2. Navigate to your WordPress installation directory.

3. Run the following command: wp plugin list --fields=name,version --format=table | grep "Advanced Custom Fields: Extended" This command will output the name and version of the Advanced Custom Fields: Extended plugin if it is installed.

Compare the version number returned by either method against the patched version. If your site runs Advanced Custom Fields: Extended version 0.9.2.7 or earlier, it is exposed to this vulnerability.

What an attacker actually does

The Advanced Custom Fields: Extended plugin contains an arbitrary file deletion vulnerability. This issue stems from insufficient validation of file paths within the plugin's code. Specifically, the vulnerability is classified as an "Improper Limitation of a Pathname to a Restricted Directory," often referred to as a path traversal vulnerability. This means that the plugin does not adequately restrict the file paths provided to it, allowing an attacker to manipulate these paths.

An unauthenticated attacker can exploit this flaw to delete arbitrary files on the server where the WordPress site is hosted. By crafting a malicious request, the attacker can trick the plugin into deleting files outside of its intended operational directory. This capability to delete files anywhere on the server can have severe consequences. For instance, if an attacker deletes critical WordPress configuration files, such as wp-config.php, it can disrupt the site's functionality.

The deletion of key files like wp-config.php can lead to a complete site outage or, more critically, enable remote code execution. When wp-config.php is deleted, WordPress may enter an installation state, allowing an attacker to potentially reconfigure the site with malicious settings or gain control. While the direct impact of arbitrary file deletion is rated with a medium severity score, the potential for subsequent remote code execution elevates the risk significantly, as it can lead to full compromise of the affected server.

How to detect a compromise

Detecting a compromise related to arbitrary file deletion can involve observing unusual site behavior, examining server logs, and checking the integrity of critical files. Since this vulnerability allows for the deletion of arbitrary files, the primary indicators of compromise will often be related to missing or corrupted files.

Site Behavior Indicators:

• Site Downtime or Errors: If critical files like wp-config.php are deleted, the WordPress site will likely stop functioning correctly. Users might encounter "Error establishing a database connection" messages, HTTP 500 errors, or a blank white screen.

• WordPress Installation Screen: If wp-config.php is deleted, accessing the site's URL might present the standard WordPress installation setup screen, as if WordPress had never been installed or configured. This is a strong indicator that the configuration file is missing.

• Missing Plugin or Theme Functionality: If an attacker deletes specific plugin or theme files, parts of your site's functionality might break or disappear.

Server and WordPress Logs:

• Server Error Logs: Check your web server's error logs (e.g., Apache error.log, Nginx error.log) for entries indicating files not found or permission errors related to WordPress core files, especially wp-config.php. Look for entries around the time the site issues began.

• WordPress Debug Log: If WordPress debugging is enabled (define('WP_DEBUG', true); in wp-config.php), check wp-content/debug.log for file-related errors or warnings that might point to missing files.

• Access Logs: Review web server access logs for unusual HTTP requests. While the exact exploit payload is not specified, look for requests that appear to target unusual paths or involve parameters that might be used for file path manipulation. Requests that result in HTTP 404 (Not Found) errors for files that should exist, immediately preceding site issues, could be relevant.

File System Integrity Checks:

• Manual File Verification: Manually check for the presence of crucial WordPress files, particularly wp-config.php in the root directory of your WordPress installation.

• Core File Integrity Check (WP-CLI): If you have WP-CLI access, you can use the following command to check the integrity of WordPress core files. This command compares your core files with a fresh WordPress download and reports any discrepancies, including missing files: wp core verify-checksums This will not directly detect deleted plugin files but can confirm if core WordPress files are intact.

A combination of these checks can help identify if a file deletion attack has occurred. The most immediate and noticeable sign will often be the site's inability to function due to missing critical files.

How to fix

The primary method to address this vulnerability is to update the Advanced Custom Fields: Extended plugin to a secure version.

Follow these numbered steps to remediate the vulnerability:

1. Update the Plugin: Update your Advanced Custom Fields: Extended plugin to version 0.9.2.8 or a later supported release. This version, released on October 19, 2026, includes security fixes that resolve the arbitrary file deletion vulnerability. The update specifically addresses insufficient file path validation and includes a fix for an Ajax Form security vulnerability. Updating ensures that the plugin properly resolves paths against a permitted base directory, verifies containment after normalization, and correctly authorizes file operations, preventing attackers from deleting arbitrary files.

   • Via WordPress Administration Dashboard:

     1. Log in to your WordPress administration area.

     2. Navigate to "Plugins" > "Installed Plugins".

     3. Locate "Advanced Custom Fields: Extended" in the list.

     4. If an update is available, a notice will appear below the plugin name. Click "Update Now" to initiate the update process.

   • Via WP-CLI:

     1. Connect to your server via SSH.

     2. Navigate to your WordPress installation directory.

     3. Run the command: wp plugin update acf-extended

After updating, verify that the plugin is running version 0.9.2.8 or higher to confirm the patch has been applied successfully.

Timeline

Sources

• https://nvd.nist.gov/vuln/detail/CVE-2026-112311

• https://www.wordfence.com/threat-intel/vulnerabilities/id/2d98419c-b411-4579-8225-c9695d2099e7

• https://wordpress.org/plugins/acf-extended/

• https://www.cve.org/CVERecord?id=CVE-2026-112311