CVE-2026-48906

The vulnerability in the Tassos Framework Plugin allows users to delete arbitrary files on the affected sites.

CVSS 4.0

9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H/AU:Y

CVSS 3.1

8.1CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

EPSS

0.3% chance of exploitation in the next 30 days; higher than 18% of CVEs (scores of 2026-10-25)

CWE

CWE-284

Published

2026-05-27

Modified

2026-10-14

Record from

the NVD, synced 2026-10-19

Affected

• tassos:advanced_custom_fields
• tassos:convert_forms
• tassos:engagebox
• tassos:google_structured_data
• tassos:mailchimp_auto-subscribe
• tassos:smile_pack
• tassos:tassos_code_snippets
• tassos:tassos_framework

References

• https://tassos.gr

Check your stackJSON