CVE-2026-10752Published
Advanced Custom Fields: Extended <= 0.9.2.6 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via Email Action Dynamic File Field
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-10752 · Microsoft / collected KEV context
cve-program · CVE-2026-10752
- https://www.wordfence.com/threat-intel/vulnerabilities/id/ed7f3f80-4d08-440f-b990-b1099a565ed0?source=cve
- https://plugins.trac.wordpress.org/browser/acf-extended/tags/0.9.2.3/includes/modules/form/module-form-action-email.php#L149
- https://plugins.trac.wordpress.org/browser/acf-extended/tags/0.9.2.3/includes/modules/form/module-form-action-email.php#L178
- https://plugins.trac.wordpress.org/changeset/3667996/acf-extended
Related operational evidence
Explicit CVE identifiers- Advanced Custom Fields: Extended <= 0.9.2.6 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via Email Action Dynamic File Field · Newly collected advisory · 27 Oct 2026