Executive brief
A vulnerability in a popular WordPress plugin extension allows unauthorized individuals to create new administrator accounts on affected websites. By bypassing security checks during user registration, an attacker can gain full control over the site's management and data. This issue specifically affects sites using public-facing forms configured to create new users.
Technical details
The vulnerability is caused by the after_validate_save_post() function unconditionally trusting the attacker-controlled _acf_post_id POST parameter without authentication or integrity verification. This allows an attacker to trigger a cleanup branch that discards validation errors not prefixed with 'acfe:', effectively suppressing security checks for role allow-lists and administrator-role capability guards. Consequently, an unauthenticated attacker can force the wp_insert_user() function to execute with an administrator role argument. Exploitation requires a public ACFE frontend form configured with a 'Create User' action that maps a role field. A patch is available in versions following 0.9.2.5.
Affected products
- ACFE Advanced Custom Fields: Extended (ACFE) up to and including 0.9.2.5
Timeline
- 2026-05-28: disclosed
- 2026-05-28: advisory
References
- https://plugins.trac.wordpress.org/browser/acf-extended/tags/0.9.2.4/includes/hooks.php
- https://plugins.trac.wordpress.org/browser/acf-extended/tags/0.9.2.4/includes/module-acf.php
- https://plugins.trac.wordpress.org/browser/acf-extended/tags/0.9.2.4/includes/modules/form/module-form-action-user.php
- https://plugins.trac.wordpress.org/browser/acf-extended/tags/0.9.2.4/includes/modules/form/module-form-front.php
- https://plugins.trac.wordpress.org/changeset/3551665/acf-extended
- https://www.wordfence.com/threat-intel/vulnerabilities/id/bd332f49-5aa9-4207-89db-84692a6430e0?source=cve