LmCast :: Stay tuned in

ACF plugin bug gives hackers admin on 50,000 WordPress sites

Recorded: Jan. 21, 2026, 12:03 a.m.

Original Summarized

ACF plugin bug gives hackers admin on 50,000 WordPress sites

News

Featured
Latest

Credential-stealing Chrome extensions target enterprise HR platforms

Microsoft releases OOB Windows updates to fix shutdown, Cloud PC bugs

Jordanian pleads guilty to selling access to 50 corporate networks

Ingram Micro says ransomware attack affected 42,000 people

Google says Gemini won’t have ads, as ChatGPT prepares to add them

OpenAI rolls out age prediction model on ChatGPT to detect your age

ACF plugin bug gives hackers admin on 50,000 WordPress sites

VoidLink cloud malware shows clear signs of being AI-generated

Tutorials

Latest
Popular

How to access the Dark Web using the Tor Browser

How to enable Kernel-mode Hardware-enforced Stack Protection in Windows 11

How to use the Windows Registry Editor

How to backup and restore the Windows Registry

How to start Windows in Safe Mode

How to remove a Trojan, Virus, Worm, or other Malware

How to show hidden files in Windows 7

How to see hidden files in Windows

Webinars
Downloads

Latest
Most Downloaded

Qualys BrowserCheck

STOPDecrypter

AuroraDecrypter

FilesLockerDecrypter

AdwCleaner

ComboFix

RKill

Junkware Removal Tool

Deals

Categories

eLearning

IT Certification Courses

Gear + Gadgets

Security

VPNs

Popular

Best VPNs

How to change IP address

Access the dark web safely

Best VPN for YouTube

Forums
More

Virus Removal Guides
Startup Database
Uninstall Database
Glossary
Send us a Tip!
Welcome Guide

HomeNewsSecurityACF plugin bug gives hackers admin on 50,000 WordPress sites

ACF plugin bug gives hackers admin on 50,000 WordPress sites

By Bill Toulas

January 20, 2026
05:12 PM
0

A critical-severity vulnerability in the Advanced Custom Fields: Extended (ACF Extended) plugin for WordPress can be exploited remotely by unauthenticated attackers to obtain administrative permissions.
ACF Extended, currently active on 100,000 websites, is a specialized plugin that extends the capabilities of the Advanced Custom Fields (ACF) plugin with features for developers and advanced site builders.
The vulnerability, tracked as CVE-2025-14533, can be leveraged for admin privileges by abusing the plugin’s ‘Insert User / Update User’ form action, in versions of ACF Extended 0.9.2.1 and earlier.

The flaw arises from the lack of enforcement of role restrictions during form-based user creation or updates, and exploitation works even when role limitations are appropriately configured in the field settings.
"In the vulnerable version [of the plugin], there are no restrictions for form fields, so the user's role can be set arbitrarily, even to 'administrator', regardless of the field settings, if there is a role field added to the form," Wordfence explains.
"As with any privilege escalation vulnerability, this can be used for complete site compromise," the researchers warn.
Although the outcome from exploiting the flaw is severe, Wordfence notes that the issue is only exploitable on sites that explicitly use a ‘Create User’ or ‘Update User’ form with a role field mapped.
CVE-2025-14533 was discovered by security researcher Andrea Bocchetti, who, on December 10, 2025, submitted a report to Wordfence to validate the issue and escalate it to the vendor.
Four days later, the vendor addressed the problem and released it in ACF Extended version 0.9.2.2.
Based on download stats from wordpress.org, roughly 50,000 users have downloaded the plugin since then. Assuming all downloads were for the latest version, that leaves roughly an equal number of sites exposed to attacks.
WordPress plugin enumeration activity
Although no attacks targeting CVE-2025-14533 have been observed yet, a report from threat monitoring firm GreyNoise presents large-scale WordPress plugin reconnaissance activity aimed at enumerating potentially vulnerable sites.
According to GreyNoise, from late October 2025 to mid-January 2026, nearly 1,000 IPs across 145 ASNs targeted 706 distinct WordPress plugins in over 40,000 unique enumeration events.
The most targeted plugins are Post SMTP, Loginizer, LiteSpeed Cache, SEO by Rank Math, Elementor, and Duplicator.

Plugin enumeration activitySource: GreyNoise
Active exploitation of the Post SMTP flaw CVE-2025-11833 was reported in early November 2025 by Wordfence, and GreyNoise’s records indicate a focused effort targeting this flaw involving 91 IPs.
Another flaw GreyNoise urged admins to patch is CVE-2024-28000, which impacts LiteSpeed Cache and was marked as actively exploited by Wordfence in August 2024.

The 2026 CISO Budget Benchmark
It's budget season! Over 300 CISOs and security leaders have shared how they're planning, spending, and prioritizing for the year ahead. This report compiles their insights, allowing readers to benchmark strategies, identify emerging trends, and compare their priorities as they head into 2026.
Learn how top leaders are turning investment into measurable impact.
Download Now

Related Articles:
Hackers exploit Modular DS WordPress plugin flaw for admin accessCritical flaw in WordPress add-on for Elementor exploited in attacksGrafana warns of max severity admin spoofing vulnerabilityVMware ESXi zero-days likely exploited a year before disclosureHackers now exploiting critical Fortinet FortiSIEM flaw in attacks

Advanced Custom Fields
Enumeration
Plugin
Privilege Escalation
Vulnerability
Website
WordPress

Bill Toulas
Bill Toulas is a tech writer and infosec news reporter with over a decade of experience working on various online publications, covering open-source, Linux, malware, data breach incidents, and hacks.

Previous Article
Next Article

Post a Comment Community Rules

You need to login in order to post a comment
Not a member yet? Register Now

You may also like:

Popular Stories

Microsoft releases OOB Windows updates to fix shutdown, Cloud PC bugs

Credential-stealing Chrome extensions target enterprise HR platforms

Malicious GhostPoster browser extensions found with 840,000 installs

Sponsor Posts

New webinar: Choose-your-own-investigation walkthrough of modern browser attacks

Discover how to scale IT infrastructure reliably without adding toil or burnout.

Identity Governance & Threat Detection in one: Get a guided tour of our platform

  Upcoming Webinar

Follow us:

Main Sections

News
Webinars
VPN Buyer Guides
SysAdmin Software Guides
Downloads
Virus Removal Guides
Tutorials
Startup Database
Uninstall Database
Glossary

Community

Forums
Forum Rules
Chat

Useful Resources

Welcome Guide
Sitemap

Company

About BleepingComputer
Contact Us
Send us a Tip!
Advertising
Write for BleepingComputer
Social & Feeds
Changelog

Terms of Use - Privacy Policy - Ethics Statement - Affiliate Disclosure

Copyright @ 2003 - 2026 Bleeping Computer® LLC - All Rights Reserved

Login

Username

Password

Remember Me

Sign in anonymously

Sign in with Twitter

Not a member yet? Register Now


Reporter

Help us understand the problem. What is going on with this comment?

Spam

Abusive or Harmful

Inappropriate content

Strong language

Other

Read our posting guidelinese to learn what content is prohibited.

Submitting...
SUBMIT

A critical vulnerability, designated CVE-2025-14533, has been identified within the Advanced Custom Fields: Extended (ACF Extended) plugin for WordPress, impacting approximately 50,000 websites. The flaw stems from a lack of role restrictions during the creation or update of users via the plugin’s ‘Create User’ or ‘Update User’ form actions. Specifically, versions 0.9.2.1 and earlier allow an unauthenticated attacker to arbitrarily set a user’s role, including elevating it to ‘administrator,’ regardless of configured field settings. This privilege escalation vulnerability was discovered by Andrea Bocchetti and reported to Wordfence on December 10, 2025, with the vendor releasing version 0.9.2.2 four days later.

Concurrent with this vulnerability, threat monitoring firm GreyNoise has been conducting extensive WordPress plugin enumeration activity, targeting a range of plugins – including Post SMTP, Loginizer, LiteSpeed Cache, and SEO by Rank Math – across 145 ASNs and 706 distinct plugins. This reconnaissance campaign, spanning from late October 2025 to mid-January 2026, involved over 40,000 unique enumeration events. Notably, GreyNoise's records indicate that the Post SMTP flaw (CVE-2025-11833) was also subject to active exploitation, with 91 IPs involved in targeted attacks.

The discovery of this vulnerability coincides with ongoing security concerns highlighted by Wordfence, who alerted the public to the CVE-2024-28000 flaw impacting LiteSpeed Cache, which was also recognized as actively exploited in August 2024. This underscores the dynamic nature of WordPress security and the continuous requirement for proactive monitoring and patching. The impact of the ACF Extended vulnerability is further complicated by the broad adoption of the plugin; approximately 100,000 websites currently utilize the vulnerable version, representing a significant attack surface.

The GreyNoise activity provides valuable insight into broader WordPress security trends, suggesting a continued focus on enumerating potentially vulnerable plugins and exploiting known flaws. While no direct attacks targeting CVE-2025-14533 have been observed to date, the reconnaissance indicates a potential future threat landscape. Organizations relying on ACF Extended should prioritize patching to mitigate the risk of unauthorized administrative access. The ongoing activities of GreyNoise emphasize the importance of comprehensive website security audits and vulnerability scanning. Furthermore, the concurrent scrutiny of related vulnerabilities, such as the CVE-2024-28000 and CVE-2025-11833 exposures, highlights the interconnectedness of WordPress security and the need for a layered defense strategy.