A critical authentication vulnerability in the Advanced Custom Fields: Extended plugin allows unauthenticated attackers to hijack administrator accounts, posing a severe risk of full site compromise.

This flaw exists in the update-user action of the front-end Forms module, where the plugin fails to perform adequate authorization checks for non-administrative roles. An unauthenticated attacker can exploit this logic error to reset the password of a targeted administrator account if the form is configured to allow user profile updates.

Successful exploitation results in full unauthorized administrative access to the WordPress environment. Given the high CVSS score of 8.1, this vulnerability presents a significant risk for complete data loss, unauthorized content modification, and potential deployment of malicious backdoors, which could lead to long-term operational disruption and reputational damage.

Immediate Action: Update the Advanced Custom Fields: Extended plugin to version 0.9.2.7 or later immediately to apply the necessary capability checks.

Proactive Monitoring: Review WordPress audit logs for suspicious profile update events, particularly those involving administrative accounts or unusual source IP addresses.

Compensating Controls: If immediate patching is not feasible, disable any front-end forms provided by the plugin that allow user profile updates or utilize a Web Application Firewall (WAF) to block requests targeting the vulnerable update-user action.

Public Exploit Available: Unknown

Security teams must prioritize the update of the Advanced Custom Fields: Extended plugin across all WordPress installations. Because this vulnerability allows an unauthenticated actor to gain full administrative control, failure to patch leaves the entire application ecosystem exposed to complete takeover.