CVE-2025-14533 is a critical privilege escalation vulnerability in the hwk-fr Advanced Custom Fields: Extended plugin for WordPress, affecting all versions up to and including 0.9.2.1. The vulnerability stems from improper privilege management (CWE-269) in the 'insert_user' function, which fails to restrict the roles that can be assigned during user registration. An unauthenticated attacker can exploit this by supplying the 'administrator' role if the 'role' field is mapped to a custom field, thereby gaining administrator access to the WordPress site. The vulnerability has a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting its critical impact on confidentiality, integrity, and availability. No patch or remediation details are provided, and the plugin is not a cloud service, so remediation depends on vendor action or user mitigation.

Successful exploitation allows an unauthenticated attacker to escalate privileges to administrator level on the affected WordPress site. This grants full control over site content, configuration, and user management, severely compromising confidentiality, integrity, and availability of the site. The vulnerability affects all versions up to 0.9.2.1 of the Advanced Custom Fields: Extended plugin. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should avoid mapping the 'role' field to custom fields in the plugin configuration to prevent exploitation. Monitor vendor channels for updates and apply patches promptly once available.