What is the CVSS score of EUVD-2026-20451?

EUVD-2026-20451 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of PHP are affected by EUVD-2026-20451?

DanbiLabs Advanced Members for ACF plugin versions 1.2.5 and below contain an authenticated arbitrary file deletion vulnerability that allows Subscriber-level users to remove critical WordPress…

How to fix or mitigate EUVD-2026-20451?

Within 24 hours: Disable the DanbiLabs Advanced Members for ACF plugin or restrict access to authenticated users with Contributor role or higher; audit all Subscriber accounts for suspicious activity. Within 7 days: Contact DanbiLabs for patch timeline and interim security guidance; implement file integrity monitoring on wp-config.php and other critical WordPress files; review and restrict file system permissions on the WordPress installation directory. Within 30 days: Deploy vendor-released patch when available; conduct penetration test on the plugin functionality post-patch; implement Web Application Firewall (WAF) rules to block path traversal patterns targeting wp-config.php.

PHP EUVD-2026-20451

| CVE-2026-3243 HIGH

Path Traversal (CWE-22)

2026-04-08 Wordfence

WordPress PHP RCE Path Traversal

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 18:07 vuln.today

cvss_changed

EUVD ID Assigned

Apr 08, 2026 - 11:46 euvd

EUVD-2026-20451

Analysis Generated

Apr 08, 2026 - 11:46 vuln.today

CVE Published

Apr 08, 2026 - 11:16 nvd

HIGH 8.8

DescriptionCVE.org

The Advanced Members for ACF plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the create_crop function in all versions up to, and including, 1.2.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The vulnerability was partially patched in version 1.2.5.

AnalysisAI

Arbitrary file deletion in DanbiLabs Advanced Members for ACF plugin for WordPress (versions ≤1.2.5) allows authenticated attackers with Subscriber-level privileges to delete critical server files via path traversal, enabling remote code execution by removing wp-config.php or similar critical files. The vulnerability stems from insufficient path validation in the create_crop function and was only partially patched in version 1.2.5, leaving residual risk. CVSS 8.8 (High) reflects network accessibility with low attack complexity requiring only low-privilege authentication. No public exploit identified at time of analysis, though the attack path is straightforward for authenticated users.

Technical ContextAI

This vulnerability exploits CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) in the Advanced Members for ACF WordPress plugin's avatar handling functionality. The affected code resides in the class-avatar.php file's create_crop function, which processes user-supplied file paths without adequate sanitization. WordPress plugins run with the same privileges as the web server process, typically allowing file system operations within the WordPress installation directory. By manipulating path parameters through directory traversal sequences (../ patterns), an attacker can escape intended upload/crop directories and target arbitrary files. The plugin integrates with Advanced Custom Fields (ACF) to provide member management features, and the vulnerable code path is accessible to any authenticated user with Subscriber role or higher-WordPress's lowest privileged authenticated role. The partial patch in version 1.2.5 indicates incomplete remediation of the path validation logic, as evidenced by changesets 3479725 and 3492372 in the WordPress plugin repository.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed. Site administrators should immediately review WordPress plugin repository changesets 3479725 and 3492372 (https://plugins.trac.wordpress.org/changeset/3479725/ and https://plugins.trac.wordpress.org/changeset/3492372/) to assess patch completeness, as version 1.2.5 is documented as containing only a partial fix. Until a complete patch is released and verified, implement defense-in-depth measures: restrict Subscriber-level user registration if not business-critical, audit existing Subscriber accounts for legitimacy, implement file integrity monitoring for critical WordPress files (wp-config.php, .htaccess, core PHP files), and consider web application firewall rules to detect path traversal attempts in file operation parameters. If the plugin is not essential to site functionality, disable or remove it entirely until a comprehensive fix is released. Monitor the Wordfence threat intelligence page and WordPress plugin repository for updated versions addressing the residual vulnerability. After applying any future patches, verify remediation by testing that authenticated low-privilege users cannot manipulate file paths in avatar/crop operations.