Description

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not restrict the role submitted through its front-end user forms to the roles the form actually offers, and its safeguard against privileged roles is incomplete, allowing unauthenticated visitors to register an account with elevated capabilities and then escalate it to administrator.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-09-02T06:17:18.487Z",
  "pubdate": "2026-09-02T06:17:18.487Z",
  "executiveSummary": "The Advanced Custom Fields: Extended WordPress plugin prior to version 0.9.2.7 contains a critical security vulnerability involving improper access control in front-end user registration forms.\nThe vulnerability is classified as an improper privilege management issue, allowing unauthorized users to manipulate form input to register accounts with elevated privileges.\nBy bypassing form-level constraints, an unauthenticated attacker can supply arbitrary user roles during the registration process.\nThis flaw enables attackers to register accounts with administrator-level capabilities, leading to full site compromise.\nThe vulnerability affects all versions of the Advanced Custom Fields: Extended plugin before 0.9.2.7.\nGiven the ability for unauthenticated exploitation, this flaw poses a severe risk to WordPress installations, potentially leading to unauthorized data access, arbitrary code execution, and complete system takeover.",
  "technicalDetails": "The root cause of this vulnerability lies in the insufficient validation and sanitization of user-supplied role data within the front-end user registration functionality provided by the Advanced Custom Fields: Extended plugin.\nSpecifically, the plugin fails to restrict the user role submission to the pre-defined options intended for a specific form. Furthermore, the safeguard mechanism designed to prevent the assignment of highly privileged roles (such as 'administrator') is incomplete and easily bypassed.\nThe attack flow begins with an unauthenticated attacker interacting with a front-end form intended for user registration. During the HTTP request submission, the attacker modifies the POST parameters associated with the user role assignment.\nBecause the back-end logic fails to verify if the requested role corresponds to the intended configuration of the form or if the requested role exceeds the permissions authorized for registration, the system proceeds to create the user with the specified role.\nIf the attacker submits an 'administrator' role parameter, the application logic incorrectly trusts the user input, resulting in the creation of a new administrative account.\nThis bypass effectively renders the plugin's access control mechanisms non-functional for registration processes. Once the attacker successfully creates an account with administrative privileges, they can leverage the inherent capabilities of the WordPress administrator role to install malicious plugins, modify site content, alter database records, or gain persistent remote code execution (RCE) on the underlying server.\nThis vulnerability is particularly dangerous because it requires no prior authentication or administrative knowledge to initiate the exploitation sequence, making it highly accessible for automated exploitation bots.\nThe lack of server-side role validation against a whitelist of acceptable roles during the 'user_register' hook or equivalent registration processing functions constitutes a significant failure in secure development practices."
}