The Advanced Custom Fields: Extended plugin for WordPress contains a privilege escalation vulnerability due to improper privilege management (CWE-269). The after_validate_save_post() function unconditionally trusts the _acf_post_id POST parameter, which is attacker-controlled and lacks authentication or integrity verification. This allows an attacker to bypass validation errors related to user roles and administrator capabilities, leading to execution of wp_insert_user() with an attacker-supplied administrator role. Exploitation requires a public ACFE frontend form with a Create User action that maps a role field, enabling the creation of an administrator user account by unauthenticated attackers.

Successful exploitation results in an unauthenticated attacker gaining administrator-level access to the affected WordPress site. This compromises confidentiality, integrity, and availability of the site, allowing full control over site content and configuration. The CVSS score of 9.8 reflects the critical severity and ease of exploitation (network attack vector, no privileges or user interaction required).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict or disable public ACFE frontend forms configured with Create User actions that map role fields to prevent exploitation. Monitor vendor channels for updates and apply patches promptly once released.