The Advanced Custom Fields: Extended plugin prior to version 0.9.2.8 and its PRO variant contain a logic flaw that fails to consistently resolve the update‑user action target between the authorization and execution stages in front‑end forms. This flaw allows an unauthenticated visitor to bypass the guard normally protecting administrator accounts, obtain the administrator's privileges, and be issued a valid session. The result is full administrative control over the WordPress site, enabling disclosure, modification, or destruction of all site data. The impact spans confidentiality, integrity, and availability, as an attacker can impersonate the administrator, modify content, plugins, themes, and potentially deploy further malicious code.

Advanced Custom Fields: Extended and Advanced Custom Fields: Extended PRO plugins on WordPress sites with versions earlier than 0.9.2.8. The vulnerability is present in both the free and PRO editions and requires the plugin to be installed and active.

Exploitability is elevated because the attacker only needs to place two front‑end form configurations that target visitor‑submitted values; no authentication is required. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, but the lack of a known exploit does not lower the inherent risk, as the described attack path directly compromises the administrator account. The CVSS score is 8.1. The risk level remains high due to the direct administrator takeover potential and the low barrier to attack.