Missing authorization in ACF Extended permits users to bypass intended access controls and exploit incorrectly configured security levels. The vulnerability allows manipulation of plugin settings or data that should be restricted, potentially exposing or altering content managed via the plugin.

WordPress ACF Extended plugin versions up to and including 0.9.2.7 are affected. The issue stems from the plugin’s access control logic, affecting any WordPress installation that has the plugin installed.

The CVSS score of 7.5 indicates a high severity. Although EPSS is not available, the lack of entries in the CISA KEV catalog suggests no known active exploitation. The attack vector most likely involves authenticated web requests to endpoints exposed by the plugin, enabling attackers with user-level access to gain elevated privileges through the plugin’s configuration paths. The exploit requires no local code execution or credential compromise beyond existing user roles, rendering it relatively straightforward on vulnerable sites.