CVE-2025-15463

The Advanced Custom Fields: Extended and Advanced Custom Fields: Extended PRO WordPress plugins from 0.9.2.4 to 0.9.2.7 do not consistently disable shortcode processing in the confirmation message of their front-end forms, allowing unauthenticated visitors to have arbitrary shortcodes executed server-side when they submit a form whose stored configuration does not carry the relevant setting.

The Advanced Custom Fields: Extended plugin for WordPress up to version 0.9.2.5 is vulnerable to privilege escalation via validation bypass. The after_validate_save_post() function unconditionally trusts the attacker-controlled _acf_post_id parameter, allowing validation errors to be suppressed and an administrator account to be created.

The Advanced Custom Fields: Extended plugin for WordPress up to 0.9.2.7 is vulnerable to sensitive information exposure. An unauthenticated attacker can extract the WordPress password hash of any user by injecting a {get_user} template tag that is resolved and written as a publicly readable term name. This requires a public [acfe_form] shortcode page with a Term action using a save.name field mapping.

The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to authorization bypass in all versions up to and including 0.9.2.6 due to improper verification that a user is authorized to perform an action. Unauthenticated attackers can permanently delete arbitrary WordPress media library attachments by supplying a numeric attachment ID in the form submission without ownership or capability verification.

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not restrict the role submitted through its front-end user forms to the roles the form actually offers, and its safeguard against privileged roles is incomplete. This allows unauthenticated visitors to register an account with elevated capabilities and then escalate it to administrator.

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not verify that the requester is authorized to edit the targeted user account in the update-user action of its front-end Forms module; it only checks a capability when the submitted role is administrator or super_admin. On a site that exposes a publicly reachable front-end form whose user-update action targets an existing administrator and maps the password to a visitor-submitted field, an unauthenticated visitor can overwrite that administrator's password and take over the account. The default target is the submitting user, so exploitation depends on the form being configured to target another account.