An authentication bypass flaw in the Advanced Custom Fields: Extended WordPress plugin permits non‑logged in users to delete arbitrary media library attachments. The plugin fails to verify that the user has permission, allowing a request that supplies a numeric attachment identifier to permanently remove the file. Because the action originates from a public form with an email action, the vulnerability can be exploited without any credentials and without access to the WordPress admin interface.

Affected installations are those running Advanced Custom Fields: Extended version 0.9.2.6 or earlier. The plugin is typically deployed on WordPress sites that use its public‑facing forms; within the form the email action may leverage a dynamic file field bound to a source field with the delete option enabled. Site administrators using this configuration are directly impacted.

The CVSS score of 4.8 indicates moderate impact. EPSS is not available, and the flaw is not listed in CISA KEV. Exploitation requires only a crafted form submission, so the attack can be performed from any network. An attacker can deploy a malicious link or embed the form in a phishing page to trigger deletion. Once the attachment is removed, there is potential for confusion or content loss, but no direct path to code execution or privilege escalation.