{"id":"CVE-2026-48906","title":"The vulnerability in the Tassos Framework Plugin allows users to delete arbitrary files on the affected sites.","summary":"The vulnerability in the Tassos Framework Plugin allows users to delete arbitrary files on the affected sites.","severity":"high","cvss":8.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","cwe":["CWE-284"],"vendor":"tassos","product":"advanced_custom_fields","affected":["advanced_custom_fields >= 1.0.0, <= 2.8.12","advanced_custom_fields >= 3.0.0, <= 3.1.3","convert_forms >= 1.0.0, <= 4.4.12","convert_forms >= 5.0.0, <= 5.1.5","engagebox >= 1.0.0, <= 6.3.11","engagebox >= 7.0.0, <= 7.1.1","google_structured_data >= 1.0.0, <= 5.6.11","google_structured_data >= 6.0.0, <= 6.1.9","mailchimp_auto-subscribe >= 1.0.0, <= 5.0.5","mailchimp_auto-subscribe >= 5.1.0, <= 5.2.0","smile_pack >= 1.0.0, <= 1.2.6","smile_pack >= 2.0.0, <= 2.1.0","tassos_code_snippets = 1.0.0","tassos_framework >= 1.0.0, <= 6.0.1"],"published":"2026-05-27","updated":"2026-10-14","sourceUpdated":"2026-10-14T20:10:00.190","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-48906","references":[{"url":"https://tassos.gr","label":"security@joomla.org"}],"tags":["nvd"],"epss":0.00382,"epssPercentile":0.30461,"ingestedAt":"2026-10-14T20:53:12.319Z","slug":"CVE-2026-48906","body":"## Overview\n\nThe vulnerability in the Tassos Framework Plugin allows users to delete arbitrary files on the affected sites.\n\n## Affected\n\n- `advanced_custom_fields >= 1.0.0, <= 2.8.12`\n- `advanced_custom_fields >= 3.0.0, <= 3.1.3`\n- `convert_forms >= 1.0.0, <= 4.4.12`\n- `convert_forms >= 5.0.0, <= 5.1.5`\n- `engagebox >= 1.0.0, <= 6.3.11`\n- `engagebox >= 7.0.0, <= 7.1.1`\n- `google_structured_data >= 1.0.0, <= 5.6.11`\n- `google_structured_data >= 6.0.0, <= 6.1.9`\n- `mailchimp_auto-subscribe >= 1.0.0, <= 5.0.5`\n- `mailchimp_auto-subscribe >= 5.1.0, <= 5.2.0`\n- `smile_pack >= 1.0.0, <= 1.2.6`\n- `smile_pack >= 2.0.0, <= 2.1.0`\n- `tassos_code_snippets = 1.0.0`\n- `tassos_framework >= 1.0.0, <= 6.0.1`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":45,"depthScoreParts":{"impact":44.6,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}