The vulnerability exists because the plugin does not confirm that the requester has permission to edit the target user account within the front‑end Forms module. The check is applied only when the target is an administrator. As a result, an unauthenticated visitor who can submit a form that maps the user‑update action to a visitor‑supplied user identifier is able to overwrite the credentials of any non‑administrator account, effectively hijacking that account's session and achieving full control of the victim user. The flaw constitutes a clear authorization bypass that directly impacts confidentiality, integrity, and availability of the user accounts.

WordPress sites running Advanced Custom Fields: Extended or Advanced Custom Fields: Extended PRO at versions earlier than 0.9.2.8 are affected. The issue applies to all releases prior to 0.9.2.8; administrators should verify the current plugin version and upgrade immediately if they are still on 0.9.2.7 or earlier.

The vulnerability permits a complete account takeover of any non‑administrator account without authentication. The attacker only needs the site to expose a front‑end form whose user‑update action is mapped to a visitor‑supplied value. The CVSS score of 8.1 indicates a high‑severity flaw, with an EPSS score of < 1% and a KEV listing absent. The nature of the flaw allows an attacker to assume a victim account and potentially move laterally within the site, making it a serious concern, particularly on sites using front‑end user‑update forms.