CyberHappenings logo
☰
Home Browse Watchlists Experimental About

Track cybersecurity events as they unfold. Sourced timelines. Filter, sort, and browse. Fast, privacy‑respecting. No invasive ads, no tracking.

Critical Privilege Escalation Vulnerability in ACF Extended Plugin

First reported
Last updated
1 unique sources, 1 articles

Summary

Hide ▲

A critical-severity vulnerability (CVE-2025-14533) in the Advanced Custom Fields: Extended (ACF Extended) plugin for WordPress allows unauthenticated attackers to gain administrative privileges. The flaw affects versions 0.9.2.1 and earlier, impacting approximately 50,000 WordPress sites. The issue arises from the lack of role restrictions during user creation or updates, enabling attackers to arbitrarily set user roles to 'administrator'. The vulnerability was discovered by Andrea Bocchetti and patched in version 0.9.2.2, released on December 14, 2025. GreyNoise reports large-scale WordPress plugin reconnaissance activity, with 1,000 IPs across 145 ASNs targeting 706 distinct plugins, including ACF Extended, in over 40,000 enumeration events from late October 2025 to mid-January 2026.

Timeline

  1. 21.01.2026 00:12 1 articles · 23h ago

    CVE-2025-14533 in ACF Extended Plugin Patched

    A critical-severity vulnerability in the ACF Extended plugin, tracked as CVE-2025-14533, was discovered by Andrea Bocchetti and reported to Wordfence on December 10, 2025. The vendor released a patch in version 0.9.2.2 on December 14, 2025. The flaw allows unauthenticated attackers to gain administrative privileges by exploiting the 'Insert User / Update User' form action. Approximately 50,000 WordPress sites remain potentially vulnerable if they have not updated to the latest version.

    Show sources
    Open in new tab

Information Snippets