Use Advanced Custom Fields on your Website? Update it now.
This is one of those stories that reminds us why “I’ll update it later” can be risky 😬
A critical vulnerability has been discovered in a popular WordPress plugin called Advanced Custom Fields: Extended.
It puts around 50,000 websites at risk of full takeover.
To understand why this matters, a bit of context helps.
WordPress powers a huge portion of the web. Many sites rely on plugins to add extra functionality, and one of the most widely used is Advanced Custom Fields (ACF).
It lets developers add custom content fields to pages and posts.
The Extended version builds on that, adding even more flexibility.
The problem is that certain versions of this plugin didn’t properly enforce role restrictions when creating or updating users through forms.
Under the right conditions, someone who isn’t logged in at all could create a new user account and assign themselves the administrator role.
And administrator access on a WordPress site means everything. Content, users, plugins, themes… full control.
Now, there is an important caveat.
This isn’t an exploit that affects every site automatically.
For the vulnerability to be abused, a site needs to be using specific user creation or update forms with role mapping enabled.
That reduces the immediate blast radius.
But the severity rating is still 9.8 out of 10, which tells you how bad things could get if the conditions are right.
The good news is that the issue is fixed in a newer version of the plugin. More than half of affected sites have been updated.
The less good news is that tens of thousands haven’t. And once a vulnerability becomes public, attackers don’t need it to be easy. They need it to be possible.
There’s currently no evidence of this flaw being exploited in the wild. But history tells us that public disclosures often lead to scanning, probing, and automated attacks shortly afterwards.
One outdated plugin can undo layers of good work elsewhere.
🤔 When was the last time you checked whether the set and forget parts of your website were still being maintained?