GCVE - cpe:2.3:a:danbilabs:advanced_members_for

Approved changes feed: RSS · Atom

cpe:2.3:a:danbilabs:advanced_members_for_acf:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Danbilabs (`551b77cd-db10-5be6-84f0-d67428e8c20c`)
Product	Advanced Members For Acf (`17c81bf3-db36-5762-bf32-0fc3215ac808`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from gcve-enriched-dumps CVE data

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-3243`	vulnerable	2026-06-08 08:01:18.262608	Advanced Members for ACF <= 1.2.5 - Authenticated (Subscriber+) Arbitrary File Deletion via Path Traversal HIGH (8.8) The Advanced Members for ACF plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the create_crop function in all versions up to, and including, 1.2.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The vulnerability was partially patched in version 1.2.5. Published: 2026-04-08T11:16:57.732Z Updated: 2026-04-08T16:41:44.695Z Open on db.gcve.eu Reference links https://www.wordfence.com/threat-intel/vulnerabilities/id/22b63369-c6ea-42e9-bea3-d15837da7732?source=cve https://plugins.trac.wordpress.org/browser/advanced-members/tags/1.2.4/core/modules/class-avatar.php#L57 https://plugins.trac.wordpress.org/browser/advanced-members/tags/1.2.4/core/modules/class-avatar.php#L266 https://plugins.trac.wordpress.org/browser/advanced-members/trunk/core/modules/class-avatar.php#L710 https://plugins.trac.wordpress.org/changeset/3479725/	Imported from gcve-enriched-dumps CVE data

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.