The Advanced Custom Fields: Extended plugin for WordPress contains a validation bypass that allows an attacker to force the plugin to discard role validation errors, enabling the creation of a new administrator-level user account without any authentication. By sending a crafted POST request containing the _acf_post_id parameter, the plugin’s after_validate_save_post() routine ignores all validation checks added by acfe_field_user_roles and acfe_module_form_action_user, causing wp_insert_user() to execute with an attacker‑supplied administrator role. This results in unrestricted account takeover and full administrative privileges on the affected site.

All versions of the Advanced Custom Fields: Extended plugin up to and including 0.9.2.5 are vulnerable. No other vendors or products are identified; the issue affects only this WordPress plugin.

The CVSS score of 9.8 marks this flaw as Critical, and the absence of an EPSS score indicates that the exploitability has not been formally quantified. The plugin must be publicly accessible with a frontend form configured for user creation and role mapping to trigger the flaw, making the attack vector a typical unauthenticated HTTP POST request. Although not yet listed in CISA’s KEV catalog, the high rating and straightforward exploitation path suggest that attackers could discover and exploit this vulnerability quickly if no mitigation is applied.