PatchTheCVECVE-2026-48906: The vulnerability in the Tassos Framework Plugin allows users to delete arbitrary files on the affected sites.
33
Routine
HIGH 8.1UPGRADEUPGRADEUPGRADE
CVE-2026-48906 is a high-severity flaw (CVSS 8.1) affecting advanced custom fields, convert forms, engagebox. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
The vulnerability in the Tassos Framework Plugin allows users to delete arbitrary files on the affected sites.
Why this priority
- High severity
A fixed release or distro patch exists.
Risk facts
| CVSS score | 8.1 (High) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | Low |
| User interaction | None |
| EPSS exploit chance | 0.3% (top 81%) |
| CISA exploited list | No |
| Weakness | CWE-284 |
| Published | 2026-05-27 |
| Last modified | 2026-10-14 |
Publisher (CNA): Joomla! Project · Vendor: tassos
Last updated 2026-10-14 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
tassos advanced custom fields UPGRADE
Affected: >= 1.0.0 and <= 2.8.12 · >= 3.0.0 and <= 3.1.3
Fixed in: newer than 3.1.3
Safe to downgrade to: a release before 1.0.0
1. Check installed version
apt-cache policy advanced-custom-fields || rpm -q advanced-custom-fields || advanced-custom-fields --version
2. UPGRADE to newer than 3.1.3 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade advanced-custom-fields
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade advanced-custom-fields
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before 1.0.0 (Debian / Ubuntu)
apt-cache madison advanced-custom-fields
sudo apt install advanced-custom-fields=<VERSION_BEFORE_1.0.0>
sudo apt-mark hold advanced-custom-fields
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list advanced-custom-fields
sudo dnf downgrade advanced-custom-fields-<VERSION_BEFORE_1.0.0>
sudo dnf versionlock add advanced-custom-fields
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
tassos convert forms UPGRADE
Affected: >= 1.0.0 and <= 4.4.12 · >= 5.0.0 and <= 5.1.5
Fixed in: newer than 5.1.5
Safe to downgrade to: a release before 1.0.0
1. Check installed version
apt-cache policy convert-forms || rpm -q convert-forms || convert-forms --version
2. UPGRADE to newer than 5.1.5 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade convert-forms
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade convert-forms
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before 1.0.0 (Debian / Ubuntu)
apt-cache madison convert-forms
sudo apt install convert-forms=<VERSION_BEFORE_1.0.0>
sudo apt-mark hold convert-forms
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list convert-forms
sudo dnf downgrade convert-forms-<VERSION_BEFORE_1.0.0>
sudo dnf versionlock add convert-forms
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
tassos engagebox UPGRADE
Affected: >= 1.0.0 and <= 6.3.11 · >= 7.0.0 and <= 7.1.1
Fixed in: newer than 7.1.1
Safe to downgrade to: a release before 1.0.0
1. Check installed version
apt-cache policy engagebox || rpm -q engagebox || engagebox --version
2. UPGRADE to newer than 7.1.1 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade engagebox
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade engagebox
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before 1.0.0 (Debian / Ubuntu)
apt-cache madison engagebox
sudo apt install engagebox=<VERSION_BEFORE_1.0.0>
sudo apt-mark hold engagebox
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list engagebox
sudo dnf downgrade engagebox-<VERSION_BEFORE_1.0.0>
sudo dnf versionlock add engagebox
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
tassos google structured data UPGRADE
Affected: >= 1.0.0 and <= 5.6.11 · >= 6.0.0 and <= 6.1.9
Fixed in: newer than 6.1.9
Safe to downgrade to: a release before 1.0.0
1. Check installed version
apt-cache policy google-structured-data || rpm -q google-structured-data || google-structured-data --version
2. UPGRADE to newer than 6.1.9 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade google-structured-data
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade google-structured-data
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before 1.0.0 (Debian / Ubuntu)
apt-cache madison google-structured-data
sudo apt install google-structured-data=<VERSION_BEFORE_1.0.0>
sudo apt-mark hold google-structured-data
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list google-structured-data
sudo dnf downgrade google-structured-data-<VERSION_BEFORE_1.0.0>
sudo dnf versionlock add google-structured-data
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
tassos mailchimp auto-subscribe UPGRADE
Affected: >= 1.0.0 and <= 5.0.5 · >= 5.1.0 and <= 5.2.0
Fixed in: newer than 5.2.0
Safe to downgrade to: a release before 1.0.0
1. Check installed version
apt-cache policy mailchimp-auto-subscribe || rpm -q mailchimp-auto-subscribe || mailchimp-auto-subscribe --version
2. UPGRADE to newer than 5.2.0 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade mailchimp-auto-subscribe
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade mailchimp-auto-subscribe
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before 1.0.0 (Debian / Ubuntu)
apt-cache madison mailchimp-auto-subscribe
sudo apt install mailchimp-auto-subscribe=<VERSION_BEFORE_1.0.0>
sudo apt-mark hold mailchimp-auto-subscribe
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list mailchimp-auto-subscribe
sudo dnf downgrade mailchimp-auto-subscribe-<VERSION_BEFORE_1.0.0>
sudo dnf versionlock add mailchimp-auto-subscribe
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
tassos smile pack UPGRADE
Affected: >= 1.0.0 and <= 1.2.6 · >= 2.0.0 and <= 2.1.0
Fixed in: newer than 2.1.0
Safe to downgrade to: a release before 1.0.0
1. Check installed version
apt-cache policy smile-pack || rpm -q smile-pack || smile-pack --version
2. UPGRADE to newer than 2.1.0 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade smile-pack
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade smile-pack
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before 1.0.0 (Debian / Ubuntu)
apt-cache madison smile-pack
sudo apt install smile-pack=<VERSION_BEFORE_1.0.0>
sudo apt-mark hold smile-pack
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list smile-pack
sudo dnf downgrade smile-pack-<VERSION_BEFORE_1.0.0>
sudo dnf versionlock add smile-pack
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-48906?
advanced custom fields: upgrade to newer than 3.1.3; convert forms: upgrade to newer than 5.1.5; engagebox: upgrade to newer than 7.1.1. Exact commands for each OS are on this page.
Is CVE-2026-48906 being exploited?
CVE-2026-48906 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-48906 affect?
CVE-2026-48906 affects advanced custom fields, convert forms, engagebox. Severity is high (CVSS 8.1). The vulnerability in the Tassos Framework Plugin allows users to delete arbitrary files on the affected sites.
How urgent is CVE-2026-48906?
Priority 33/100. High severity