Critical WordPress Vulnerability Affects Thousands of Sites in North East India

A recently discovered vulnerability in the Advanced Custom Fields: Extended (ACF Extended) plugin for WordPress could potentially compromise over 50,000 websites, including those in the North East region of India. This security issue, tracked as CVE-2025-14533, allows unauthenticated attackers to gain administrative access.

Understanding the Vulnerability

The flaw arises from the lack of enforcement of role restrictions during form-based user creation or updates in versions of ACF Extended 0.9.2.1 and earlier. Exploitation works even when role limitations are appropriately configured in the field settings.

Impact and Exploitation

The vulnerability can be leveraged for admin privileges by abusing the plugin's Insert User / Update User form action. However, the issue is only exploitable on sites that use a Create User or Update User form with a role field mapped.

Plugin Enumeration Activity

Although no attacks targeting CVE-2025-14533 have been observed yet, threat monitoring firm GreyNoise has reported large-scale WordPress plugin reconnaissance activity aimed at enumerating potentially vulnerable sites.

Relevance to North East India and Broader Context

With over 100,000 websites using ACF Extended, it is likely that a significant number of sites in the North East region of India are affected by this vulnerability. It is essential for WordPress site administrators in the region to be aware of this issue and take necessary steps to secure their sites.

Mitigation and Best Practices

To mitigate the risk, site administrators are advised to update ACF Extended to version 0.9.2.2, which addresses the problem. It is also crucial to maintain a secure and up-to-date WordPress environment, including keeping all plugins and themes updated.

Looking Forward

As WordPress continues to be a popular platform for websites in India and beyond, it is essential for site administrators to stay vigilant and be aware of potential security threats. By following best practices and keeping their sites updated, they can help ensure the security and integrity of their online presence.