Advanced Custom Fields: Extended EUVD-2026-110756

Exploitation requires a specific non-default deployment: a site administrator must have published a public-facing ACF Extended form containing an Email action whose attachment row uses a dynamic {field:...} source bound to a submittable field with the Delete option enabled. Only then can an unauthenticated attacker (PR:N) permanently delete an arbitrary attachment by supplying its numeric attachment ID in the form submission, with no ownership or capability verification performed. Limiting factors: the vulnerable form configuration is not present by default, so sites without such a public ACFE Email-action form are not exposed; the attacker must know or enumerate valid numeric attachment IDs; and impact is confined to deletion of media attachments (no read access, no code execution). These conditions are the reason the supplied CVSS vector uses AC:H.

Signals point to a genuine but conditional, mid-tier issue rather than a drop-everything emergency. The CVSS 3.1 base is 4.8 (Medium) with AV:N/AC:H/PR:N/UI:N: reachable over the network with no authentication (PR:N) and no user interaction, but with high attack complexity (AC:H) that reflects a substantial non-default precondition. Impact is limited to Integrity-Low and Availability-Low (C:N) - the flaw permanently deletes media library attachments, it does not read data or achieve code execution. KEV status is not present, so this is not confirmed actively exploited; no public exploit is identified in the input (references are the Wordfence advisory, source lines, and the patch changeset, not a PoC); and no EPSS score is supplied, so probabilistic exploitation likelihood cannot be quantified from this data. The vuln.today decision label is 'this_month' (not act_now/emergency), which is consistent with the picture: unauthenticated network reach is offset by the AC:H precondition that a site admin must have deployed a specific public-facing ACFE form configuration. Net: patch on a normal maintenance cadence, prioritizing sites that actually run public ACFE Email-action forms; this is not a high-CVSS-but-trivial issue, but neither does the data show widespread opportunistic exploitation.

On a WordPress site whose administrator has published a public-facing ACF Extended form with an Email action whose attachment row is bound via a dynamic {field:...} source to a submittable field with the Delete option enabled, an unauthenticated visitor submits the form while supplying a numeric attachment ID they do not own. Because the plugin performs no ownership or capability check, the referenced media library attachment is permanently deleted. No public exploit code is identified at time of analysis; the attacker only needs to send a crafted form submission.