Horizon Alert
Summary of the vulnerability and why it matters
A critical vulnerability has been identified in the Advanced Custom Fields: Extended WordPress plugin that could allow unauthenticated attackers to create new administrator accounts on affected sites. This issue arises from a validation bypass that enables the suppression of security checks when creating or updating user roles, potentially leading to unauthorized privilege escalation. The main concern is confirming relevance and exposure given the specific configuration required for exploitation.
- Attackers can create admin accounts.
- Potential for unauthorized site control.
- Verify plugin use and configuration.
Attack Path
How an attacker could exploit the issue
An unauthenticated attacker can exploit this vulnerability by interacting with a public frontend form on a target WordPress site, provided that form is configured with a "Create User" action. The attacker would submit a specially crafted POST request, bypassing validation checks to assign themselves an administrator role, ultimately leading to the creation of a new administrator-level user account.
- Entry condition: Public frontend form with Create User action.
- Trigger point: Attacker-controlled POST parameter bypasses validation.
- Resulting risk: New administrator account creation.
Live Threat
Current exploitation, exposure, and threat context
When supported by the advisory, unauthenticated attackers could create new administrator-level user accounts on a WordPress site. This is possible when a public frontend form is configured with a Create User action that bypasses role validation.
- New administrator accounts could be created.
- Via a public frontend form's user creation.
- Site control could be gained by attackers.
Operational Fix
Recommended remediation, mitigation, and detection steps
The application owner is likely responsible for managing the Advanced Custom Fields: Extended plugin on WordPress. The first step is to identify all instances of this plugin, determine if they are exposed externally and configured with the vulnerable 'Create User' action, and then confirm the specific asset owners before planning remediation.
- Application owners should manage this issue.
- Verify public-facing forms with user creation.
- Coordinate vendor updates and plan maintenance.
