Loading story…
A critical privilege-escalation flaw, tracked as CVE-2025-14533, was disclosed in the WordPress plugin Advanced Custom Fields: Extended, enabling an unauthenticated attacker to register or modify a user account with the administrator role under certain configurations. The bug was traced to improper role restrictions in the plugin’s user creation and editing form handling, specifically the insert_user function, which could allow full compromise of a vulnerable WordPress instance.
The issue affects version 0.9.2.1 and earlier, and reporting indicated that roughly 100,000 WordPress sites were affected. Exploitation requires exposed Create User or Update User forms that make the role field available, increasing risk for sites using those features insecurely. The plugin maintainers released version 0.9.2.2 and later to fix the vulnerability, and defenders were urged to update immediately and review sites for unauthorized administrator accounts.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
The plugin developers released Advanced Custom Fields: Extended version 0.9.2.2 or later to fix CVE-2025-14533. The vulnerability affects version 0.9.2.1 and earlier.
A critical privilege-escalation vulnerability, tracked as CVE-2025-14533, was disclosed in the WordPress plugin Advanced Custom Fields: Extended. The flaw allows an unauthenticated attacker to assign themselves the administrator role during registration when vulnerable Create User or Update User forms expose the role field.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical vulnerability, **CVE-2025-14533**, was disclosed in the WordPress plugin *Advanced Custom Fields: Extended* affecting versions **<= 0.9.2.1**. The issue is an **unauthenticated privilege escalation** in the plugin’s user-form handling, where the `insert_user` logic does not properly restrict which roles can be assigned during registration; as a result, an attacker can submit a registration request specifying the **`administrator`** role and obtain full administrative access under certain configurations. Reporting indicates exploitation depends on site configuration: the flaw is reachable when a form is set up such that the **`role`** value is mapped to a custom field / user role field is present in the form. The weakness was identified by **Andrea Bocchetti** via the **Wordfence Bug Bounty Program**, and is associated with **CWE-269 (Improper Privilege Management)**; once admin access is obtained, attackers can fully compromise the site (e.g., upload malicious plugins/themes, plant backdoors, or alter content for redirects).
Jun 29, 2026
A critical unauthenticated remote code execution vulnerability has been identified in the *Advanced Custom Fields: Extended* plugin for WordPress, affecting versions 0.9.0.5 through 0.9.1.1. The flaw resides in the `prepare_form()` function, which improperly handles user input by passing it directly to `call_user_func_array()`, enabling attackers to execute arbitrary code on the server without authentication. This vulnerability allows threat actors to inject backdoors, create new administrative accounts, and potentially take full control of affected WordPress sites. Security researchers warn that exploitation of this vulnerability could lead to complete compromise of website integrity and confidentiality, including data theft and malware installation. Administrators are strongly advised to update the plugin to a secure version, implement Zero Trust security models, enable multi-factor authentication for admin accounts, and harden PHP configurations. The vulnerability is mapped to MITRE ATT&CK techniques T1059 (Command and Scripting Interpreter) and T1190 (Exploit Public-Facing Application).
Jun 29, 2026
Two newly disclosed vulnerabilities in WordPress plugins can let attackers elevate privileges to **Administrator** by abusing improper handling of user profile metadata. `CVE-2026-4261` affects **Expire Users** through version `1.2.2`, where the `save_extra_user_profile_fields` function allows modification of the `on_expire_default_to_role` meta value; an authenticated attacker with **Subscriber-level access or higher** can exploit the flaw to gain full administrative control. The issue was classified as `CWE-862` and carries a high-severity `CVSS v3.1` score with the vector `AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`. A second flaw, `CVE-2026-3629`, impacts **Import and export users and customers** through version `1.29.7` and can, under specific conditions, allow even **unauthenticated** attackers to become administrators. The plugin's `save_extra_user_profile_fields` logic fails to block sensitive keys such as `wp_capabilities` because `get_restricted_fields` does not restrict them, enabling a crafted registration request to assign elevated privileges when **"Show fields in profile"** is enabled and a previously imported CSV included a `wp_capabilities` column header. That vulnerability was classified as `CWE-269` with a `CVSS v3.1` vector of `AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H`.
Jun 29, 2026