CVE-2026-112311 ACF Extended CVE debrief

Who should care

Defenders responsible for WordPress installations using the ACF Extended plugin should assess exposure and prioritize remediation by verifying the plugin version, reviewing file access controls, and monitoring for suspicious activities. They need to focus on updating to a version beyond 0.9.2.7 if necessary, reviewing file access controls to prevent unauthorized file deletions, and monitoring for suspicious file to

Why it matters

CVE-2026-112311 is a medium-severity vulnerability in the WordPress ACF Extended plugin that allows for arbitrary file deletion. Defenders should prioritize verifying the plugin version, reviewing file access controls, and monitoring for suspicious activities.

• Defenders need to verify the version of the ACF Extended plugin in use and update to prevent potential file deletions.
• File access controls should be reviewed to prevent unauthorized file deletions.
• Monitoring for suspicious file deletion activities is necessary to detect potential exploitation.

Technical summary

The WordPress ACF Extended plugin has a vulnerability that allows for arbitrary file deletion due to improper limitation of a pathname to a restricted directory, also known as path traversal. This issue affects versions from n/a through 0.9.2.7 and has a CVSS score of 6.5, indicating a medium severity level. Defenders should assess exposure and prioritize remediation by verifying the plugin version, reviewing file access controls, and monitoring for suspicious file deletion activities.

Defensive priority

Defenders should prioritize verifying the version of the ACF Extended plugin in use and updating to a version beyond 0.9.2.7 if necessary. They should also review file access controls and monitor for suspicious file deletion activities.

Recommended defensive actions

• Verify the version of the ACF Extended plugin in use and update to a version beyond 0.9.2.7 if necessary.
• Review file access controls to prevent unauthorized file deletions.
• Monitor for suspicious file deletion activities.

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description, affected versions, and CVSS score. However, there is limited information on exploitation or victim impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.