CVSS 6.9 (medium) · published 2026-11-05
Joomla Extension - tassos.gr - File deletion through improper access control in Advanced Custom Fields extension 2.8.13-2.8.15, 3.1.4-3.1.8 and Smile Pack 1.2.7-1.2.9, 2.1.2-2.1.6 - Anyone could delete images in the Gallery folders, including images on published articles and modules, without logging in. In ACF 3.1.7 and 3.1.8, users could also see, remove or save each other’s unsaved uploads.
Weakness: CWE-284
Source: NVD CVE-2026-115451
Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.