CVE-2026-3243: Advanced Members ACF Path Traversal Flaw

CVE-2026-3243 Overview

The Advanced Members for ACF plugin for WordPress contains a critical arbitrary file deletion vulnerability due to insufficient file path validation in the create_crop function. This vulnerability affects all versions up to and including 1.2.5 and allows authenticated attackers with Subscriber-level access or higher to delete arbitrary files on the server. Successful exploitation can lead to remote code execution when critical files such as wp-config.php are deleted, potentially compromising the entire WordPress installation.

Critical Impact

Authenticated attackers can delete arbitrary files on the server, enabling potential remote code execution through deletion of critical WordPress configuration files.

Affected Products

• Advanced Members for ACF plugin for WordPress versions up to and including 1.2.5
• WordPress installations with the vulnerable plugin activated
• Any server hosting WordPress with the affected plugin versions

Discovery Timeline

• April 8, 2026 - CVE-2026-3243 published to NVD
• April 8, 2026 - Last updated in NVD database

Technical Details for CVE-2026-3243

Vulnerability Analysis

This vulnerability is classified as CWE-22 (Path Traversal), a category of input validation flaws that allows attackers to access or manipulate files outside intended directories. The create_crop function within the class-avatar.php module fails to properly validate file paths before performing deletion operations.

The core issue stems from the plugin accepting user-controlled input for file path parameters without adequate sanitization. Attackers with even minimal authentication (Subscriber-level) can manipulate these parameters to specify arbitrary file paths on the server. When the function processes the delete operation, it operates on the attacker-supplied path rather than being constrained to the intended avatar image directory.

The most concerning attack scenario involves deleting wp-config.php, which contains database credentials and WordPress salts. Removing this file forces WordPress into installation mode, allowing an attacker to reconfigure the site and establish administrative access, effectively achieving remote code execution.

Root Cause

The root cause is insufficient file path validation in the create_crop function located in class-avatar.php. The function accepts file path parameters without properly sanitizing for directory traversal sequences (such as ../) or validating that the target file resides within the expected upload directory. This allows authenticated users to break out of the intended file system boundaries and target arbitrary files.

Attack Vector

The vulnerability is exploitable over the network by authenticated attackers with Subscriber-level privileges or above. The attack does not require user interaction and can be executed directly through crafted requests to the vulnerable function. An attacker would:

1. Authenticate to the WordPress site with at least Subscriber-level access
2. Craft a malicious request to the create_crop function with a manipulated file path containing directory traversal sequences
3. Target critical files such as wp-config.php for deletion
4. Exploit the resulting site misconfiguration to gain full administrative access

The vulnerable code sections can be reviewed in the WordPress Plugin Trac repository, specifically examining the file handling logic around lines 57, 266, and 710 in the class-avatar.php module. The partial patch applied in version 1.2.5 and subsequent changes can be viewed in WordPress Changeset #3479725 and WordPress Changeset #3492372.

Detection Methods for CVE-2026-3243

Indicators of Compromise

• Unexpected deletion of critical WordPress files such as wp-config.php, .htaccess, or core WordPress files
• Web server error logs showing file not found errors for recently existing configuration files
• WordPress installation wizard appearing unexpectedly, indicating wp-config.php deletion
• Suspicious POST requests to avatar or crop-related endpoints containing path traversal patterns

Detection Strategies

• Monitor file integrity of critical WordPress files including wp-config.php, wp-settings.php, and .htaccess using file integrity monitoring solutions
• Implement Web Application Firewall (WAF) rules to detect and block path traversal patterns (../, ..%2f, etc.) in requests to the Advanced Members plugin endpoints
• Review web server access logs for unusual requests targeting the class-avatar.php module or crop-related AJAX handlers
• Deploy endpoint detection to alert on unexpected file deletion operations in the WordPress installation directory

Monitoring Recommendations

• Enable detailed WordPress audit logging to track all file operations performed by authenticated users
• Configure real-time alerts for deletion of files in the WordPress root directory and wp-content folder
• Monitor for Subscriber-level accounts making unusual administrative requests or accessing avatar management functions
• Implement canary files in sensitive directories to detect unauthorized file system access attempts

How to Mitigate CVE-2026-3243

Immediate Actions Required

• Update the Advanced Members for ACF plugin to the latest available version beyond 1.2.5 that contains the complete security fix
• Audit all Subscriber-level and above user accounts for legitimacy and remove any suspicious accounts
• Implement backup procedures for critical WordPress files including wp-config.php to enable rapid recovery
• Consider temporarily deactivating the plugin if an update is not immediately available

Patch Information

The vulnerability was partially patched in version 1.2.5 of the Advanced Members for ACF plugin. Review the security patches applied in WordPress Changeset #3479725 and WordPress Changeset #3492372 for complete remediation details. For additional vulnerability details, consult the Wordfence Vulnerability Report.

Workarounds

• Restrict user registration to prevent attackers from obtaining Subscriber-level access, or require administrator approval for new accounts
• Implement server-level file permissions to prevent the web server user from deleting critical files like wp-config.php
• Deploy a Web Application Firewall with rules specifically blocking path traversal patterns in plugin-related requests
• Use WordPress security plugins to implement additional access controls on file operations and monitor for suspicious activity

# Example: Protect wp-config.php at the server level (Apache .htaccess)
<files wp-config.php>
order allow,deny
deny from all
</files>

# Example: Set immutable attribute on critical files (Linux)
sudo chattr +i /var/www/html/wp-config.php