The Advanced Custom Fields: Extended WordPress plugin, before 0.9.2.7, has a missing authorization check in its front‑end Forms module. When an unauthenticated user submits a user‑update request that targets an existing administrator account, the plugin only verifies the caller’s capability if the submitted role field is set to administrator or super_admin. In other cases it blindly accepts the request, allowing the attacker to overwrite the administrator’s password and take full control of the account. This flaw effectively turns the front‑end form into a backdoor for a privileged account.

WordPress sites running Advanced Custom Fields: Extended plugins older than version 0.9.2.7, especially those exposing a publicly reachable front‑end form that can target administrator accounts or map the password field to visitor input. Sites that use a visitor‑submittable field to dictate the target account are also at risk if the form is configured to target a different user than the submitter.

The vulnerability allows remote, unauthenticated attackers to gain full administrative privileges. While the CVSS score is not disclosed in the available data, the impact is severe due to the privilege escalation. EPSS scoring is unavailable, and the vulnerability is not listed in the CISA KEV catalog, but the lack of authorization checks makes exploitation straightforward for anyone who can reach the front‑end form. The attack vector is likely through a published website with the vulnerable form, and it requires no additional credentials beyond form submission ability.