{"schema":"threatline.record/2","record":{"id":"CVE-2026-10752","aliases":[],"summary":"Advanced Custom Fields: Extended <= 0.9.2.6 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via Email Action Dynamic File Field","details":"The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 0.9.2.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to permanently delete arbitrary WordPress media library attachments by supplying a numeric attachment ID in the form submission without any ownership or capability verification. Exploitation requires a site administrator to have configured a public-facing ACFE form with an Email action whose attachment row uses a dynamic {field:...} source bound to a submittable field with the Delete option enabled.","categories":["Unclassified"],"product":"Advanced Custom Fields: Extended","vendor":"hwk-fr","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-10752","source_modified_at":"2026-10-27T11:32:04.243Z","fetched_at":"2026-10-27T16:27:21.584480Z","product":"Advanced Custom Fields: Extended","vendor":"hwk-fr","versions":[{"version":"0","status":"affected","lessThanOrEqual":"0.9.2.6","versionType":"semver"}],"defaultStatus":"unaffected"}],"fixed_versions":[],"cvss":4.8,"severity":"Medium","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-27T11:32:04.243Z","modified_at":"2026-10-27T11:32:04.243Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-10752","fetched_at":"2026-10-27T16:27:21.584480Z","source_modified_at":"2026-10-27T11:32:04.243Z"}],"sources":["CVE List"],"references":[{"source":"CVE List","url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ed7f3f80-4d08-440f-b990-b1099a565ed0?source=cve"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/acf-extended/tags/0.9.2.3/includes/modules/form/module-form-action-email.php#L149"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/acf-extended/tags/0.9.2.3/includes/modules/form/module-form-action-email.php#L178"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/changeset/3667996/acf-extended"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-27T11:32:04.243Z","content_hash":"3c1a7da9a556bdc6c395c9b092f459b8ae431378b0b6d5570590b977da1896eb"}}