The Advanced Members for ACF plugin for WordPress suffers from insufficient file path validation in the create_crop function. This flaw allows an authenticated user with Subscriber status or higher to trigger a file deletion request that bypasses path checks, enabling removal of any file on the server, such as wp-config.php. Removing such critical files can permit an attacker to overwrite configuration, inject malicious code, or otherwise compromise the entire WordPress installation.

The vulnerable plugin is distributed by danbilabs under the name Advanced Members for ACF. Versions up to and including 1.2.5 are affected. WordPress sites that have installed this plugin, particularly those that grant Subscriber or higher roles the ability to use the cropping feature, are at risk. The issue also persists in earlier releases, such as 1.2.4, as noted in the plugin repository.

The CVSS score of 8.8 indicates high severity. Because the flaw is exploitable by any authenticated user with the minimal Subscriber role, its potential impact is large. Although no publicly known exploit is available and the vulnerability is not listed in the CISA KEV catalog, attackers could delete critical files and potentially gain remote code execution or deny service. The patch in version 1.2.5 partially addresses the issue, but administrators should update to the latest release to eliminate the risk.