Advanced Custom Fields: Extended

ACF Extended 0.9.2.2 through 0.9.2.6 does not restrict a front-end registration role to the roles offered by the form, and its privileged-role safeguard is incomplete. An unauthenticated visitor can register with elevated capabilities and then escalate the account to Administrator.

ACF Extended before 0.9.2.7 does not verify authorization to edit the user targeted by a front-end form's update-user action, except when the submitted role itself is Administrator or super_admin. If a public form is configured to target an existing Administrator and maps the password from a visitor-controlled field, an unauthenticated visitor can replace that Administrator's password and take over the account. The default target is the submitting user, so exploitation requires this non-default form configuration.

ACF Extended through 0.9.2.6 does not enforce the authorization required for an affected operation. A Contributor can cross that boundary and change protected ACF Extended or site state.

Advanced Custom Fields: Extended is affected by privilege escalation or authentication bypass. The vulnerable path is reachable without authentication. A successful request can grant permissions or access that the caller should not possess. The published affected range is <= 0.9.2.5.

Advanced Custom Fields: Extended is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is <= 0.9.2.3.

Advanced Custom Fields: Extended is affected by privilege escalation or authentication bypass. The vulnerable path is reachable without authentication. A successful request can grant permissions or access that the caller should not possess.

Advanced Custom Fields: Extended is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.