An unauthenticated attacker can trigger the front‑end post update action in the Advanced Custom Fields: Extended or Pro plugin without any capability check, enabling them to overwrite any post on the site. By using malicious content in the overwrite payload, the attacker can lead to arbitrary code execution on the server. The vulnerability resides in missing authorization and allows the attacker to manipulate field definitions that the site stores in posts.

The vulnerability affects WordPress sites that have the Advanced Custom Fields: Extended or Advanced Custom Fields: Extended PRO plugin installed with a version earlier than 0.9.2.8. Both the free and pro versions are susceptible when the plugin’s front‑end form actions are enabled.

The CVSS score is 9.0, which signifies a high severity flaw—unauthenticated remote code execution. The EPSS score of 0.00192 indicates a very low exploitation probability, and the issue is not currently listed in the CISA KEV catalog. The attack vector is inferred to be remote via a publicly accessible front‑end form. Successful exploitation would give the attacker full control over the web server.