CVE-2025-14533 — AI Deep Analysis Summary

Q: Who is affected? (Versions/Components)

🏢 **Vendor**: hwk-fr. 📦 **Product**: Advanced Custom Fields: Extended. 📅 **Affected Versions**: **0.9.2.1** and earlier. ✅ **Safe Version**: 0.9.2.2+.

Q: What can hackers do? (Privileges/Data)

👑 **Privileges**: Attackers gain **Administrator** access. 🔓 **Data**: Full read/write access to WordPress core, plugins, and database. 🌐 **Scope**: Complete control over the website backend.

Q: Is exploitation threshold high? (Auth/Config)

🔓 **Auth**: **None required** (Unauthenticated). 🌍 **Network**: Remote (AV:N). ⚡ **Complexity**: Low (AC:L). 🚀 **Threshold**: **Very Low**. Easy to exploit for anyone.

Q: Is there a public Exp? (PoC/Wild Exploitation)

📜 **Public Exp**: No specific PoC code listed in data. 🔍 **References**: WordFence and Trac links available. 🌐 **Wild Exp**: Likely high due to low complexity and lack of auth.

Q: Is it fixed officially? (Patch/Mitigation)

✅ **Fixed**: Yes. 📦 **Patch**: Update to version **0.9.2.2** or later. 🔗 **Source**: WordPress Trac repository. 🔄 **Action**: Immediate plugin update recommended.

Q: Is it urgent? (Priority Suggestion)

🔴 **Priority**: **CRITICAL**. 🚨 **Urgency**: **Immediate Action Required**. ⏳ **Risk**: CVSS 9.8 (High). 💡 **Advice**: Patch now to prevent total site takeover.

Updated May 06, 2026 CVSS 9.8 · Critical

This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login. Read the full analysis →

Q1What is this vulnerability? (Essence + Consequences)

🚨 **Essence**: A critical security flaw in 'Advanced Custom Fields: Extended' for WordPress. 📉 **Consequences**: Unauthenticated attackers can escalate privileges to **Admin**.…

Read full answer (login)

Q2Root Cause? (CWE/Flaw)

🛡️ **CWE**: CWE-269 (Improper Privilege Management). 🔍 **Flaw**: The `insert_user` function fails to restrict user registration roles.…

Read full answer (login)

Q3Who is affected? (Versions/Components)

🏢 **Vendor**: hwk-fr. 📦 **Product**: Advanced Custom Fields: Extended. 📅 **Affected Versions**: **0.9.2.1** and earlier. ✅ **Safe Version**: 0.9.2.2+.

Q4What can hackers do? (Privileges/Data)

👑 **Privileges**: Attackers gain **Administrator** access. 🔓 **Data**: Full read/write access to WordPress core, plugins, and database. 🌐 **Scope**: Complete control over the website backend.

Q5Is exploitation threshold high? (Auth/Config)

🔓 **Auth**: **None required** (Unauthenticated). 🌍 **Network**: Remote (AV:N). ⚡ **Complexity**: Low (AC:L). 🚀 **Threshold**: **Very Low**. Easy to exploit for anyone.

Q6Is there a public Exp? (PoC/Wild Exploitation)

📜 **Public Exp**: No specific PoC code listed in data. 🔍 **References**: WordFence and Trac links available. 🌐 **Wild Exp**: Likely high due to low complexity and lack of auth.

Q7How to self-check? (Features/Scanning)

🔍 **Check**: Scan for 'Advanced Custom Fields: Extended' plugin. 📊 **Version**: Verify version is **< 0.9.2.2**. 🛠️ **Tool**: Use WPScan or manual plugin directory check.…

Read full answer (login)

Q8Is it fixed officially? (Patch/Mitigation)

✅ **Fixed**: Yes. 📦 **Patch**: Update to version **0.9.2.2** or later. 🔗 **Source**: WordPress Trac repository. 🔄 **Action**: Immediate plugin update recommended.

Q9What if no patch? (Workaround)

🚫 **Disable**: Deactivate the plugin if update isn't possible. 🛡️ **Restrict**: Block unauthenticated user registration in WP settings. 🧱 **WAF**: Use Web Application Firewall to block suspicious registration requests.…

Read full answer (login)

Q10Is it urgent? (Priority Suggestion)

🔴 **Priority**: **CRITICAL**. 🚨 **Urgency**: **Immediate Action Required**. ⏳ **Risk**: CVSS 9.8 (High). 💡 **Advice**: Patch now to prevent total site takeover.

Continue exploring

Vulnerability detail Full AI analysis (login) hwk-fr CWE-269