High severity8.1NVD Advisory· Published May 27, 2026· Updated Jun 17, 2026

CVE-2026-48906

Description

The vulnerability in the Tassos Framework Plugin allows users to delete arbitrary files on the affected sites.

LLM-synthesized narrative grounded in this CVE's description and references.

Tassos/Advanced Custom Fields
cpe:2.3:a:tassos:advanced_custom_fields:*:*:*:*:*:joomla\!:*:*
Range: >=1.0.0,<=2.8.12
Tassos/Convert Forms
cpe:2.3:a:tassos:convert_forms:*:*:*:*:*:joomla\!:*:*
Range: >=1.0.0,<=4.4.12
Tassos/Engagebox
cpe:2.3:a:tassos:engagebox:*:*:*:*:*:joomla\!:*:*
Range: >=1.0.0,<=6.3.11
Tassos/Google Structured Data
cpe:2.3:a:tassos:google_structured_data:*:*:*:*:*:joomla\!:*:*
Range: >=1.0.0,<=5.6.11
Tassos/Mailchimp Auto Subscribe
cpe:2.3:a:tassos:mailchimp_auto-subscribe:*:*:*:*:*:joomla\!:*:*
Range: >=1.0.0,<=5.0.5
Tassos/Smile Pack
cpe:2.3:a:tassos:smile_pack:*:*:*:*:*:joomla\!:*:*
Range: >=1.0.0,<=1.2.6
Tassos/Tassos Code Snippets
cpe:2.3:a:tassos:tassos_code_snippets:1.0.0:*:*:*:*:joomla\!:*:*
Tassos/Tassos Framework2 versions
cpe:2.3:a:tassos:tassos_framework:*:*:*:*:*:joomla\!:*:*+ 1 more
- cpe:2.3:a:tassos:tassos_framework:*:*:*:*:*:joomla\!:*:*range: >=1.0.0,<=6.0.1
- (no CPE)