ACF Extended WordPress Plugin Missing Authorization Code Execution Flaw

The Advanced Custom Fields: Extended and Advanced Custom Fields: Extended PRO WordPress plugins before version 0.9.2.8 contain a missing capability check vulnerability.

When updating a post through a front-end form action, the plugin does not verify user permissions. This allows unauthenticated visitors to overwrite arbitrary posts, including posts storing field definitions, potentially leading to arbitrary code execution on the server.

Exploitation requires the site to publish a form whose post-update action maps both its target and its content to visitor-submitted values.