danbilabs vulnerabilities

Products

• Advanced Members for ACF 2

Latest danbilabs CVEs

Newest publication first

1. CVE-2026-116624 Advanced Members for ACF <= 1.3.0 - Authenticated (Subscriber+) Privilege Escalation via Account Change-Password Form

   Published 2026-11-06

   High·CVSS 8.8

   The Advanced Members for ACF plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.3.0 via the acf[_amem_local_user_password] parameter of the [advanced-members-account-password] shortcode form submission. This is due to a PHP operator...

2. CVE-2026-3243 Advanced Members for ACF <= 1.2.5 - Authenticated (Subscriber+) Arbitrary File Deletion via Path Traversal

   Published 2026-04-08

   High·CVSS 8.8

   The Advanced Members for ACF plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the create_crop function in all versions up to, and including, 1.2.5. This makes it possible for authenticated attackers, with Subscriber-level a...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.