Loading vulnerability…
CVE-2025-14533 is a critical privilege-escalation vulnerability in the Advanced Custom Fields: Extended plugin for WordPress affecting versions up to and including 0.9.2.1. The flaw is caused by insufficient server-side restriction of assignable user roles in the plugin’s user creation workflow, specifically the insert_user function used by the plugin’s form actions for creating or updating users. When a form is configured to map a role field, attacker-controlled input can be passed into WordPress user creation logic without properly enforcing intended role limitations. As a result, an unauthenticated remote attacker can submit a crafted registration request specifying a privileged role such as administrator and have the account created with that role. The issue is configuration-dependent and is exploitable only when a site exposes a Create User or Update User form that includes a mapped role field.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
No public exploits tracked yet. Mallory keeps watching.
No public exploit code observed for this vulnerability.
18 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A critical privilege escalation vulnerability in the WordPress ACF-Extended plugin affecting versions up to and including 0.9.2.1, caused by the insert_user function not restricting roles during registration. Under specific configuration conditions, unauthenticated attackers can register an administrator account.
An unauthenticated privilege escalation vulnerability in the WordPress Advanced Custom Fields Extended (ACFE) plugin (<= 0.9.2.1) where the insert_user registration flow does not restrict user roles, enabling attackers to register with elevated roles. The same exposed AJAX endpoint is also used to confirm arbitrary function invocation, indicating broader impact.
Unknown
A critical privilege escalation vulnerability in the WordPress plugin Advanced Custom Fields: Extended caused by improper restriction of user roles in the insert_user function, allowing an unauthenticated remote attacker to assign themselves the administrator role during registration under certain form configurations.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.