The Advanced Custom Fields: Extended WordPress plugin, before 0.9.2.7, has a missing authorization check in its front-end Forms module. When an unauthenticated user submits a user-update request that targets an existing administrator account, the plugin only verifies the caller’s capability if the submitted role field is set to administrator or super_admin. In other cases it blindly accepts the request, allowing the attacker to overwrite the administrator’s password and take full control of the account. This flaw effectively turns the front-end form into a backdoor for a privileged account.

WordPress sites running Advanced Custom Fields: Extended plugins older than version 0.9.2.7, especially those exposing a publicly reachable front-end form that can target administrator accounts or map the password field to visitor input. Sites that use a visitor-submittable field to dictate the target account are also at risk if the form is configured to target a different user than the submitter.

The vulnerability allows remote, unauthenticated attackers to gain full administrative privileges. The CVSS score is 8.1, indicating high severity, and the impact is severe due to the privilege escalation. The EPSS score of 0.00145 indicates a very low but non-zero exploitation probability, and the vulnerability is not listed in the CISA KEV catalog, but the lack of authorization checks makes exploitation straightforward for anyone who can reach the front-end form. The description does not explicitly state the attack vector; it is inferred that the vector involves submitting the form via the publicly reachable front-end form, and it requires no additional credentials beyond form submission ability.