Unauthenticated Privilege Escalation in Advanced Custom Fields: Extended for WordPress
CVE-2025-14533 is a critical privilege-escalation vulnerability in the Advanced Custom Fields: Extended (ACF Extended) WordPress plugin affecting versions up to and including 0.9.2.1. The flaw is in the plugin’s user form handling, specifically the insert_user() function in the acfe_module_form_action_user class, which fails to enforce server-side restrictions on assignable roles during user creation or update. When a public ACFE form is configured with a Create User or Update User action and the role attribute is mapped to a custom field, an unauthenticated attacker can submit a crafted request specifying a privileged role such as administrator. The plugin passes the supplied role into WordPress user creation logic without properly restricting it, resulting in creation or update of an account with elevated privileges.
Are you exposed to this one?
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
Impact, mitigation & remediation
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
Impact
What an attacker gets, and what they’ve been doing with it.
Mitigation
If you can’t patch tonight, do this now.
Remediation
Patch, then assume compromise.
Exploits
No public exploits tracked yet. Mallory keeps watching.
No public exploit code observed for this vulnerability.
Recent activity
16 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An unauthenticated privilege escalation vulnerability in the WordPress Advanced Custom Fields Extended (ACFE) plugin (<= 0.9.2.1) where the insert_user registration flow does not restrict user roles, enabling attackers to register with elevated roles. The same exposed AJAX endpoint is also used to confirm arbitrary function invocation, indicating broader impact.
Unknown
Unauthenticated privilege escalation in the WordPress ACF Extended plugin allowing arbitrary role assignment (including administrator) during form-based user creation/update due to missing role restriction enforcement.
Unauthenticated privilege escalation in the Advanced Custom Fields: Extended (acf-extended) WordPress plugin that allows an attacker to create a new user with the Administrator role by submitting a crafted registration/profile form request when a role field is mapped and backend role restrictions are not enforced.
The version that knows your environment.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.