CVE-2026-48906High· 8.1▾ Twilight

The vulnerability in the Tassos Framework Plugin allows users to delete arbitrary files on the affected sites.

▾ Twilight zone — High severity, or a signal on a lesser flaw

Depth score45/ 100 · Moderate

impact 44.6 · likelihood 0.1 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

May 27, 2026

Updated

Oct 14, 2026

CVSS

8.1

Vendor

tassos

Product

advanced_custom_fields

CWE

CWE-284

Depth score

45 · Moderate

EPSS

0.38% · p30

Platforms

—

Source

NVD

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

3 events · 140 days

May 27, 2026Published
Disclosed via NVD
Oct 14, 2026Record revised
Last analysed / modified upstream
Oct 14, 2026EPSS first tracked
0.4%

tassos CWE-284 #nvd

Affected

advanced_custom_fields >= 1.0.0, <= 2.8.12
advanced_custom_fields >= 3.0.0, <= 3.1.3
convert_forms >= 1.0.0, <= 4.4.12
convert_forms >= 5.0.0, <= 5.1.5
engagebox >= 1.0.0, <= 6.3.11
engagebox >= 7.0.0, <= 7.1.1
google_structured_data >= 1.0.0, <= 5.6.11
google_structured_data >= 6.0.0, <= 6.1.9
mailchimp_auto-subscribe >= 1.0.0, <= 5.0.5
mailchimp_auto-subscribe >= 5.1.0, <= 5.2.0
smile_pack >= 1.0.0, <= 1.2.6
smile_pack >= 2.0.0, <= 2.1.0
tassos_code_snippets = 1.0.0
tassos_framework >= 1.0.0, <= 6.0.1

Full technical detail▾

Overview

The vulnerability in the Tassos Framework Plugin allows users to delete arbitrary files on the affected sites.

Affected

advanced_custom_fields >= 1.0.0, <= 2.8.12
advanced_custom_fields >= 3.0.0, <= 3.1.3
convert_forms >= 1.0.0, <= 4.4.12
convert_forms >= 5.0.0, <= 5.1.5
engagebox >= 1.0.0, <= 6.3.11
engagebox >= 7.0.0, <= 7.1.1
google_structured_data >= 1.0.0, <= 5.6.11
google_structured_data >= 6.0.0, <= 6.1.9
mailchimp_auto-subscribe >= 1.0.0, <= 5.0.5
mailchimp_auto-subscribe >= 5.1.0, <= 5.2.0
smile_pack >= 1.0.0, <= 1.2.6
smile_pack >= 2.0.0, <= 2.1.0
tassos_code_snippets = 1.0.0
tassos_framework >= 1.0.0, <= 6.0.1

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

[email protected] — https://tassos.gr

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd

← Back to feed

CVE-2026-48906High· 8.1▾ Twilight

The vulnerability in the Tassos Framework Plugin allows users to delete arbitrary files on the affected sites.

▾ Twilight zone — High severity, or a signal on a lesser flaw

Depth score45/ 100 · Moderate

impact 44.6 · likelihood 0.1 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

May 27, 2026

Updated

Oct 14, 2026

CVSS

8.1

Vendor

tassos

Product

advanced_custom_fields

CWE

CWE-284

Depth score

45 · Moderate

EPSS

0.38% · p30

Platforms

—

Source

NVD

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

3 events · 140 days

May 27, 2026Published
Disclosed via NVD
Oct 14, 2026Record revised
Last analysed / modified upstream
Oct 14, 2026EPSS first tracked
0.4%

tassos CWE-284 #nvd

Affected

advanced_custom_fields >= 1.0.0, <= 2.8.12
advanced_custom_fields >= 3.0.0, <= 3.1.3
convert_forms >= 1.0.0, <= 4.4.12
convert_forms >= 5.0.0, <= 5.1.5
engagebox >= 1.0.0, <= 6.3.11
engagebox >= 7.0.0, <= 7.1.1
google_structured_data >= 1.0.0, <= 5.6.11
google_structured_data >= 6.0.0, <= 6.1.9
mailchimp_auto-subscribe >= 1.0.0, <= 5.0.5
mailchimp_auto-subscribe >= 5.1.0, <= 5.2.0
smile_pack >= 1.0.0, <= 1.2.6
smile_pack >= 2.0.0, <= 2.1.0
tassos_code_snippets = 1.0.0
tassos_framework >= 1.0.0, <= 6.0.1

Full technical detail▾

Overview

The vulnerability in the Tassos Framework Plugin allows users to delete arbitrary files on the affected sites.

Affected

advanced_custom_fields >= 1.0.0, <= 2.8.12
advanced_custom_fields >= 3.0.0, <= 3.1.3
convert_forms >= 1.0.0, <= 4.4.12
convert_forms >= 5.0.0, <= 5.1.5
engagebox >= 1.0.0, <= 6.3.11
engagebox >= 7.0.0, <= 7.1.1
google_structured_data >= 1.0.0, <= 5.6.11
google_structured_data >= 6.0.0, <= 6.1.9
mailchimp_auto-subscribe >= 1.0.0, <= 5.0.5
mailchimp_auto-subscribe >= 5.1.0, <= 5.2.0
smile_pack >= 1.0.0, <= 1.2.6
smile_pack >= 2.0.0, <= 2.1.0
tassos_code_snippets = 1.0.0
tassos_framework >= 1.0.0, <= 6.0.1

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

[email protected] — https://tassos.gr

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd