- Critical bug in ACF: Advanced WordPress plugin allows admin to arbitrarily promote roles
- Nearly 50,000 WordPress sites vulnerable despite patch in version 0.9.2.2
- No exploits have been reported yet, but attackers are likely to explore the exposed sites soon
About 50,000 WordPress websites are currently at risk of being completely taken over by a newly discovered critical vulnerability in a popular plugin.
In mid-December 2025, security researcher Andrea Bocchetti reported to Wordfence a vulnerability in Advanced Custom Fields – Extended, a plugin that adds more functionality to the Advanced Custom Fields (ACF) plugin.
ACF allows users to add custom fields to posts and pages and is currently actively used by nearly 100,000 WordPress websites.
How to stay safe
Bacchetti said the bug was caused by role restrictions not being applied properly when creating or updating users based on a form.
“In the vulnerable version, there are no restrictions on form fields, so the user role can be set arbitrarily, even to ‘admin’, regardless of the field settings when the role field is added to the form,” Wordfence explained in its advisory.
“Like any elevation of privilege vulnerability, this could be exploited to compromise an entire site.”
In other words, any unauthorized user can make themselves the admin of a WordPress site, essentially taking control of the site.
The vulnerability was discovered in versions 0.9.2.1 and earlier and is currently tracked as CVE-2025-14533. It was given a severity score of 9.8/10 (major).
On the plus side, it is not easily absorbed. Sites must use the Create User or Update User form to display the role field.
The bug was fixed in version 0.9.2.2. According to official WordPress statistics, approximately 50,000 websites have already been updated to the new version, so approximately the same number are still vulnerable.
At the time of publication, there was no evidence that the flaw was being exploited in the wild, but now that the news is out, it’s safe to assume that cybercriminals will at least start looking for vulnerabilities.
through Computer beep
The best antivirus for any budget
Follow TechRadar on Google News I Add us as your preferred source Get news, reviews and opinions from our experts in your feed. Don’t forget to click the follow button!
And, of course, you can Siga TechRadar on TikTok Get our regular updates in the form of news, reviews, unboxing and videos. WhatsApp very
