CVE-2025-14533

The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 0.9.2.1. This is due to the 'insert_user' function not restricting the roles with which a user can register. This makes it possible for unauthenticated attackers to supply the 'administrator' role during registration and gain administrator access to the site. Note: The vulnerability can only be exploited if 'role' is mapped to the custom field.

• CWE-269

• https://plugins.trac.wordpress.org/browser/acf-extended/tags/0.9.2.1/includes/modules/form/module-form-action-user.php#L636
• https://plugins.trac.wordpress.org/browser/acf-extended/tags/0.9.2.2/includes/fields/field-user-roles.php#L437
• https://plugins.trac.wordpress.org/browser/acf-extended/tags/0.9.2.2/includes/modules/form/module-form-action-user.php#L356
• https://www.wordfence.com/threat-intel/vulnerabilities/id/d44f8af2-3525-4b00-afa8-a908250cc838?source=cve

Published

Jan 20, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-14528A vulnerability was detected in D-Link DIR-803 up to 1.04. I…7.5
• CVE-2025-14529A flaw has been found in Campcodes Retro Basketball Shoes On…9.8
• CVE-2025-1453The Category Posts Widget WordPress plugin before 4.9.20 doe…4.8
• CVE-2025-14530A vulnerability has been found in SourceCodester Real Estate…7.2
• CVE-2025-14531A vulnerability was found in code-projects Rental Management…4.3
• CVE-2025-14532DobryCMS's upload file functionality allows an unauthenticat…9.8
• CVE-2025-14534A vulnerability was determined in UTT 进取 512W up to 3.1.7.7-…9.8
• CVE-2025-14535A vulnerability was identified in UTT 进取 512W up to 3.1.7.7-…9.8
• CVE-2025-14536A security flaw has been discovered in code-projects Class a…9.8
• CVE-2025-14537A weakness has been identified in code-projects Class and Ex…9.8
• CVE-2025-14538A security vulnerability has been detected in yangshare ware…3.5
• CVE-2025-14539The The Shortcode Ajax plugin for WordPress is vulnerable to…5.4