High · published May 27, 2026
The vulnerability in the Tassos Framework Plugin allows users to delete arbitrary files on the affected sites.
| Product | Versions | Fixed in |
|---|---|---|
| tassos/advanced_custom_fields | ≥ 1.0.0, ≤ 2.8.12 | — |
| tassos/advanced_custom_fields | ≥ 3.0.0, ≤ 3.1.3 | — |
| tassos/convert_forms | ≥ 1.0.0, ≤ 4.4.12 | — |
| tassos/convert_forms | ≥ 5.0.0, ≤ 5.1.5 | — |
| tassos/engagebox | ≥ 1.0.0, ≤ 6.3.11 | — |
| tassos/engagebox | ≥ 7.0.0, ≤ 7.1.1 | — |
| tassos/google_structured_data | ≥ 1.0.0, ≤ 5.6.11 | — |
| tassos/google_structured_data | ≥ 6.0.0, ≤ 6.1.9 | — |
| tassos/mailchimp_auto-subscribe | ≥ 1.0.0, ≤ 5.0.5 | — |
| tassos/mailchimp_auto-subscribe | ≥ 5.1.0, ≤ 5.2.0 | — |
| tassos/smile_pack | ≥ 1.0.0, ≤ 1.2.6 | — |
| tassos/smile_pack | ≥ 2.0.0, ≤ 2.1.0 | — |
| tassos/tassos_code_snippets | all versions | — |
| tassos/tassos_framework | ≥ 1.0.0, ≤ 6.0.1 | — |