Vulnerability in Tassos.gr Advanced Custom Fields
CVE-2026-21627
The vulnerability was rooted in how the Tassos Framework plugin handled specific AJAX requests through Joomla’s com_ajax entry point. Under certain conditions, internal framework functionality could be invoked without proper restriction.
Published · last modified .
EPSS exploit prediction
EPSS: 0.016 (75.0th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 75th percentile — 75.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.015 · newest: 0.016 · change: +0.001
Affected products
- Tassos.gr Advanced Custom Fields — versions 2.2.0–3.1.0
- Tassos.gr Convert Forms — versions 3.2.12–5.1.0
- Tassos.gr Engagebox — versions 6.0.0–7.1.0
- Tassos.gr Google Structured Data — versions 5.1.7–6.1.0
- Tassos.gr Novarain/tassos Framework (Plg System Nrframework) — versions 4.10.14–6.0.37
- Tassos.gr Smile Pack — versions 1.0.0–2.1.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- tassos.gr (product)
Frequently asked questions
- What is CVE-2026-21627?
- CVE-2026-21627 is a vulnerability in Tassos.gr Advanced Custom Fields, classified under Improper Access Control. Published 2026-02-20.
- Is CVE-2026-21627 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.