CVE-2025-14533

CVE-2025-14533 is a critical privilege escalation vulnerability affecting all versions up to 0.9.2.1 of the Advanced Custom Fields: Extended plugin for WordPress. The flaw allows unauthenticated attackers to register with administrator privileges by exploiting the 'insert_user' function, which fails to restrict user roles during registration, provided the 'role' is mapped to a custom field. This vulnerability carries a CVSS score of 9.8 (Critical), indicating it can be exploited remotely with low complexity, leading to complete compromise of confidentiality, integrity, and availability. The potential impact is severe, granting attackers full administrative control over affected WordPress sites. While there is no known active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered significant community discussion with 4 mentions and media coverage from BleepingComputer, suggesting awareness and potential for future exploitation.