CVE-2026-3243 is a path traversal vulnerability in the Advanced Members for ACF WordPress plugin that allows authenticated users with low privileges (Subscriber-level and above) to delete arbitrary files on the server due to insufficient validation of file paths in the create_crop function. This can lead to remote code execution by deleting critical files. The vulnerability affects all versions up to and including 1.2.5, with only a partial fix applied in version 1.2.5. No complete patch or official remediation level has been confirmed by the vendor.

An attacker with Subscriber-level access or higher can delete arbitrary files on the web server, potentially causing denial of service or enabling remote code execution by removing critical files such as wp-config.php. This compromises the confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since version 1.2.5 only partially addresses the issue, administrators should monitor for vendor updates providing a full fix. Until a complete patch is available, restrict user roles carefully and consider disabling or removing the plugin if possible.