Advanced Custom Fields: Extended Privilege Escalation Vulnerability in WordPress

A privilege escalation vulnerability has been identified in the Advanced Custom Fields: Extended plugin for WordPress, affecting all versions through 0.9.2.1. The issue arises because the 'insert_user' function does not properly restrict which roles users can assign during registration. This flaw allows unauthenticated attackers to register users with the 'administrator' role, thereby gaining admin access to the site. The vulnerability can only be exploited if the 'role' field is mapped to a custom field.

Impact

Exploitation of this vulnerability allows unauthenticated users to gain administrative privileges on the WordPress site.

Reproduction

To reproduce this vulnerability, an unauthenticated user must register a new account and assign the 'administrator' role during the registration process. This can be done by mapping the 'role' field to a custom field in the registration form, using the 'insert_user' action.

Remediation

Users are advised to update the Advanced Custom Fields: Extended plugin to version 0.9.2.2 or later.