The Advanced Custom Fields: Extended plugin contains a flaw that lets an unauthenticated attacker inject a {get_user} template tag into the acf[<mapped_field>] parameter. When processed, the tag is resolved and the resulting sensitive information—such as a WordPress password hash—is written to a publicly readable term name, giving the attacker direct access to confidential user data.

All versions of the Advanced Custom Fields: Extended WordPress plugin up to and including 0.9.2.7 are affected.

With a CVSS score of 7.5 and no EPSS data, the vulnerability represents a moderate‑to‑high risk. It is not listed in the CISA KEV catalog. The attack requires that an administrator has a public [acfe_form] shortcode page configured with a Term action that maps a field to a save.name, a documented configuration. An attacker can exploit the vulnerability by sending a crafted form submission containing the {get_user} tag; the plugin processes the input and writes sensitive data to a term name visible to all visitors.