The Advanced Custom Fields and Smile Pack extensions for Joomla have a flaw that allows anyone to delete images from gallery folders, including files embedded in articles and modules, without authenticating. In certain versions of Advanced Custom Fields, users can also view, remove, or save each other’s unsaved uploads. The weakness is an improper access control issue, classified as CWE‑284, and can cause irreversible loss of media content, compromise the integrity of published information, and damage site availability and reputation.

The vulnerability affects the tassos.gr Advanced Custom Fields extension for Joomla versions 2.8.13 through 2.8.15 and 3.1.4 through 3.1.8, as well as the tassos.gr Smile Pack extension for Joomla versions 1.2.7 through 1.2.9 and 2.1.2 through 2.1.6. Administrators should verify if their sites are running any of these versions.

The CVSS score of 6.9 indicates moderate severity. EPSS data is unavailable and the vulnerability is not listed in CISA’s KEV catalog, suggesting no widespread exploitation yet. However, the flaw can be exploited remotely without authentication, simply by accessing gallery URLs, making the risk tangible for sites that expose these extensions to the public.