Critical Flaw in “Advanced Custom Fields: Extended” Exposes 100K WordPress Sites to Takeover

A critical vulnerability has been found in Advanced Custom Fields: Extended, a WordPress plugin with over 100,000 active installations, tracked as CVE-2025-14533 and rated near-maximum on the CVSS scale at 9.8, allowing unauthenticated attackers to escalate privileges to administrator and seize full control of affected sites.

The flaw lies in how the plugin handles user forms, specifically the insert_user() function of the acfe_module_form_action_user class, where permissions are not properly validated when a form includes a user role field. Even if a site administrator restricts the field, the vulnerable code does not enforce those restrictions, meaning a arbitrary role could be set in a form with a role field added to it.

According to the report, once elevated to administrator, an attacker can potentially upload malicious plugin and theme files or modify content to redirect users to spam or malware sites, effectively handing over the site. Wordfence has urged users to update to version 0.9.2.2, with the disclosure credited to Andrea Bocchetti via the Wordfence Bug Bounty Programme and a bounty of $975 awarded.

The vulnerability requires a specific configuration to be exploitable, typically a Create user or Update user form with a role field, and the article notes this may be a relatively rare scenario.