CVE-2025-14533 Vulnerability Gives Admin Access to 50,000 WordPress Sites

The Advanced Custom Fields: Extended (ACF Extended) plugin for WordPress has a critical-severity vulnerability, identified as CVE-2025-14533, that enables unauthenticated attackers to gain administrative access. This vulnerability affects approximately 50,000 websites that have not updated to version 0.9.2.2, which was released on December 14, 2025, just days after the issue was reported by security researcher Andrea Bocchetti.

The flaw arises from a lack of enforcement of role restrictions during user creation or updates via the plugin’s ‘Insert User / Update User’ form action. Even if role limitations are configured, attackers can exploit this vulnerability to set a user’s role to ‘administrator’ without restrictions, leading to complete site compromise.

While no active attacks exploiting CVE-2025-14533 have been reported, threat monitoring firm GreyNoise has observed significant reconnaissance activity targeting WordPress plugins. From late October 2025 to mid-January 2026, nearly 1,000 IPs targeted 706 distinct plugins in over 40,000 enumeration events.

Among the most targeted plugins are Post SMTP, Loginizer, LiteSpeed Cache, SEO by Rank Math, Elementor, and Duplicator. This reconnaissance suggests that attackers are actively searching for vulnerabilities to exploit, raising concerns for site administrators.

Wordfence has warned that the vulnerability can be exploited on sites using a ‘Create User’ or ‘Update User’ form with a role field mapped. This highlights the importance of monitoring plugin usage and ensuring timely updates to mitigate risks.

Understanding the Risks

For everyday users and organizations, the implications of this vulnerability are significant. If a site is compromised, attackers can gain full control, potentially leading to data breaches, loss of sensitive information, and damage to the site’s reputation.

Site administrators should be vigilant about monitoring their plugins and ensuring they are running the latest versions. Regularly checking for updates and understanding the specific functionalities of plugins can help mitigate risks associated with vulnerabilities like CVE-2025-14533.

As the landscape of cyber threats continues to evolve, staying informed about vulnerabilities and implementing best practices in plugin management is crucial for maintaining security.