CVE-2026-3243: 
WordPress vulnerability analysis and mitigation

CVE-2026-3243 is a path traversal vulnerability in the Advanced Members for ACF plugin for WordPress that allows authenticated attackers to delete arbitrary files on the server. The flaw exists in the create_crop function due to insufficient file path validation, affecting all versions up to and including 1.2.5. Deletion of critical files such as wp-config.php can lead to remote code execution and full site compromise. It was published on April 8, 2026, with a CVSS v3.1 base score of 8.8 (High) (GitHub Advisory, Wordfence).

The vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory — Path Traversal). The create_crop function in core/modules/class-avatar.php fails to properly sanitize or restrict user-supplied file path input, allowing an attacker to traverse outside the intended directory and target arbitrary files on the server. An authenticated user with Subscriber-level privileges or higher can craft a malicious request to the function, specifying a path-traversal sequence (e.g., ../../) to reference and delete sensitive files such as wp-config.php. The vulnerability was partially addressed in version 1.2.5, but complete remediation was not achieved in that release (GitHub Advisory, WordPress Trac).

Successful exploitation allows an authenticated attacker to delete arbitrary files on the WordPress server, including critical configuration files like wp-config.php. Deleting wp-config.php forces WordPress into a reinstallation state, which an attacker can exploit to reconfigure the site with attacker-controlled database credentials, effectively achieving remote code execution and full site takeover. This results in high confidentiality, integrity, and availability impact, with potential for complete compromise of the WordPress installation and any data it hosts (GitHub Advisory, Wordfence).

As of the time of reporting, there is no public proof-of-concept exploit and no confirmed in-the-wild exploitation of CVE-2026-3243. The EPSS score is approximately 0.22–0.26%, placing it in roughly the 49th percentile for exploitation likelihood within 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (GitHub Advisory, Wordfence).

1. Reconnaissance: Identify WordPress sites running the Advanced Members for ACF plugin at versions ≤1.2.5 using tools like WPScan or by inspecting plugin directories exposed via the web server.
2. Authentication: Register or obtain a Subscriber-level (or higher) account on the target WordPress site, as the vulnerability requires authenticated access.
3. Identify the vulnerable endpoint: Locate the functionality tied to the create_crop function in core/modules/class-avatar.php, which handles avatar image cropping and is accessible to authenticated users.
4. Craft malicious request: Submit a crafted HTTP request to the create_crop endpoint with a path-traversal payload (e.g., ../../wp-config.php) in the file path parameter, bypassing the insufficient validation.
5. Trigger file deletion: The server processes the traversal path and deletes the targeted file (e.g., wp-config.php) from the filesystem.
6. Achieve code execution: With wp-config.php deleted, navigate to the WordPress installation URL to trigger the setup wizard, then reconfigure the site with attacker-controlled database credentials to gain administrative access and execute arbitrary code (GitHub Advisory, Wordfence).

• Logs: Web server access logs showing POST requests to avatar/crop-related endpoints with path-traversal sequences (e.g., ../, %2e%2e%2f) in parameters; WordPress debug logs recording unexpected file operation errors.
• File System: Absence of wp-config.php or other critical WordPress files from the installation root; unexpected new wp-config.php with altered database credentials; missing plugin or theme files.
• Network: Unusual authenticated HTTP requests from low-privilege user accounts targeting avatar or image-processing endpoints; subsequent requests to the WordPress setup wizard (/wp-admin/setup-config.php) from an external IP shortly after file deletion.
• Process/Application: WordPress entering installation/setup mode unexpectedly; new administrative accounts created in the WordPress database not corresponding to legitimate registrations.

Users should update the Advanced Members for ACF plugin to the latest available version beyond 1.2.5, as version 1.2.5 only partially addressed the vulnerability (changeset 3492372 contains additional fixes). Restrict Subscriber-level account registration to only trusted users, and implement file system access controls to limit the web server user's ability to delete files outside the web root. Deploying a Web Application Firewall (WAF) with rules to detect path-traversal patterns in requests can provide an additional layer of defense. Maintain regular backups of wp-config.php and other critical files to enable rapid recovery (GitHub Advisory, WordPress Trac).

Wordfence, which discovered and reported the vulnerability, published it in their threat intelligence database and included it in their weekly WordPress vulnerability report for April 6–12, 2026. The vulnerability was noted in CISA's weekly vulnerability bulletin (SB26-103) and received standard aggregation coverage from security feeds including RedPacket Security and CVEFeed. Social media activity was limited to automated CVE broadcast accounts on Mastodon and Bluesky with no notable researcher commentary or broader community discussion (Wordfence Weekly Report, CISA Bulletin).