ACF PLUGIN BUG GIVES HACKERS ADMIN ON 50K WORDPRESS SITES

Summary from the TLDR InfoSec newsletter

Wordfence detected a new critical vulnerability in the Advanced Custom Fields Extended (ACF Extended) plugin for WordPress that could allow unauthenticated attackers to obtain admin privileges. The vulnerability arises from a lack of enforcement of role restrictions during form-based user creation. The vulnerability is only exploitable on sites that use a “Create User” or “Update User” form with the role field mapped.