CVE-2026-48906: advanced custom fields from 1.0.0 (inclusive), through 2.8.12 (inclusive), from 3.0.0 (inclusive), through 3.1.3…

Affected technology

advanced custom fields · from 1.0.0 (inclusive), through 2.8.12 (inclusive)
tassos

advanced custom fields · from 3.0.0 (inclusive), through 3.1.3 (inclusive)
tassos

convert forms · from 1.0.0 (inclusive), through 4.4.12 (inclusive)
tassos

convert forms · from 5.0.0 (inclusive), through 5.1.5 (inclusive)
tassos

engagebox · from 1.0.0 (inclusive), through 6.3.11 (inclusive)
tassos

engagebox · from 7.0.0 (inclusive), through 7.1.1 (inclusive)
tassos

google structured data · from 1.0.0 (inclusive), through 5.6.11 (inclusive)
tassos

google structured data · from 6.0.0 (inclusive), through 6.1.9 (inclusive)
tassos

mailchimp auto-subscribe · from 1.0.0 (inclusive), through 5.0.5 (inclusive)
tassos

mailchimp auto-subscribe · from 5.1.0 (inclusive), through 5.2.0 (inclusive)
tassos

smile pack · from 1.0.0 (inclusive), through 1.2.6 (inclusive)
tassos

smile pack · from 2.0.0 (inclusive), through 2.1.0 (inclusive)
tassos

tassos code snippets · 1.0.0
tassos

tassos framework · from 1.0.0 (inclusive), through 6.0.1 (inclusive)
tassos

Novarain/Tassos Framework (plg_system_nrframework) · 1.0.0-6.0.1
tassos.gr

Convert Forms · 1.0.0-4.4.12, 5.0.0-5.1.5
tassos.gr

EngageBox · 1.0.0-6.3.11, 7.0.0-7.1.1
tassos.gr

Google Structured Data · 1.0.0-5.6.11, 6.0.0-6.1.9
tassos.gr

Advanced Custom Fields · 1.0.0-2.8.12, 3.0.0-3.1.3
tassos.gr

Smile Pack · 1.0.0-1.2.6, 2.0.0-2.1.0
tassos.gr

MailChimp Auto-Subscribe · 1.0.0-5.0.5, 5.1.0-5.2.0
tassos.gr

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

Vendor/CNA’s CVSS 4.0 assessment (base score 9.3/10) rates confidentiality impact as none; integrity and availability impact as high. The description does not specify what an attacker can achieve beyond these rated impacts.