{"id":149,"date":"2026-01-19T00:00:00","date_gmt":"2026-01-18T23:00:00","guid":{"rendered":"https:\/\/helloblog.io\/hr\/kriticna-eskalacija-privilegija-acf-extended-registracija-admin-backdoor\/"},"modified":"2026-01-19T00:00:00","modified_gmt":"2026-01-18T23:00:00","slug":"kriticna-eskalacija-privilegija-acf-extended-registracija-admin-backdoor","status":"publish","type":"post","link":"https:\/\/helloblog.io\/hr\/kriticna-eskalacija-privilegija-acf-extended-registracija-admin-backdoor\/","title":{"rendered":"Kriti\u010dna eskalacija privilegija u ACF Extended: kada registracijska forma mo\u017ee postati admin backdoor"},"content":{"rendered":"\n<p>WordPress sigurnosni incidenti \u010desto izgledaju isto: jedna \u201emala\u201d postavka u pluginu + javno dostupna forma = potpuna kompromitacija weba. Upravo takav obrazac opisuje ranjivost u pluginu <strong>Advanced Custom Fields: Extended<\/strong> (ACF Extended), dodatku za ACF koji donosi naprednija polja i <em>form manager<\/em> (upravljanje formama i akcijama nakon slanja).<\/p>\n\n\n\n<p>Prema analizi Wordfencea, ranjivost omogu\u0107uje <strong>neautentificiranom napada\u010du<\/strong> (dakle bez ra\u010duna i bez prijave) da kroz formu za kreiranje korisnika zada ulogu <strong>administrator<\/strong> i time dobije administratorski pristup. Pogo\u0111eno je do <strong>0.9.2.1<\/strong>, a zakrpa je objavljena u <strong>0.9.2.2<\/strong>.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">\u0160to je ranjivo i kada je stvarno opasno<\/h2>\n\n\n\n<p>Ovo nije \u201esvaki site je odmah probijen\u201d situacija. Kriti\u010dni dio je uvjet za eksploataciju: ranjivost se mo\u017ee iskoristiti <strong>samo ako je polje <code>role<\/code> mapirano na custom field u formi<\/strong> (odnosno ako u ACF Extended formi postoji odabir uloge i ta vrijednost zavr\u0161ava u parametrima za kreiranje korisnika).<\/p>\n\n\n\n<p>Drugim rije\u010dima, rizik je najve\u0107i za siteove koji su preko ACF Extended napravili vlastiti registration flow (npr. \u201eprijavi se kao \u010dlan\/partner\u201d) i pritom izlo\u017eili odabir role ili su nesvjesno dopustili da se role po\u0161alje u requestu.<\/p>\n\n\n\n<div class=\"wp-block-group callout callout-warning is-style-warning is-layout-flow wp-block-group-is-layout-flow\" style=\"border-width:1px;border-radius:8px;padding-top:1rem;padding-right:1.5rem;padding-bottom:1rem;padding-left:1.5rem\">\n\n<h4 class=\"wp-block-heading callout-title\">Brza provjera rizika<\/h4>\n\n\n<p>Ako koristi\u0161 ACF Extended Form s akcijom \u201eCreate user\u201d ili \u201eUpdate user\u201d i u mapiranju polja ima\u0161 ne\u0161to \u0161to utje\u010de na <code>role<\/code>, tretiraj to kao hitno i a\u017euriraj plugin na 0.9.2.2.<\/p>\n\n<\/div>\n\n\n\n<h2 class=\"wp-block-heading\">Kako dolazi do eskalacije privilegija<\/h2>\n\n\n\n<p>ACF Extended ima mogu\u0107nost da kroz formu kreira korisnika (akcija tipa <code>insert_user<\/code>). U toj akciji plugin skuplja vrijednosti iz form fields i gradi <code>$args<\/code> koji zatim zavr\u0161ava u <code>wp_insert_user($args)<\/code>.<\/p>\n\n\n\n<p>Problem je u tome \u0161to (u ranjivim verzijama) <strong>ne postoji stvarno ograni\u010denje koje bi sprije\u010dilo slanje privilegirane uloge<\/strong>, iako UI\/field group postavke mogu sugerirati da je uloga ograni\u010dena (npr. opcija tipa \u201eAllow User Role\u201d). Ako se <code>role<\/code> mo\u017ee podmetnuti, napada\u010d mo\u017ee poslati <code>administrator<\/code> i dobiti admin ra\u010dun.<\/p>\n\n\n\n<div class=\"wp-block-kevinbatdorf-code-block-pro\" data-code-block-pro-font-family=\"Code-Pro-JetBrains-Mono\" style=\"font-size:.875rem;font-family:Code-Pro-JetBrains-Mono,ui-monospace,SFMono-Regular,Menlo,Monaco,Consolas,monospace;line-height:1.25rem;--cbp-tab-width:2;tab-size:var(--cbp-tab-width, 2)\"><span style=\"display:block;padding:16px 0 0 16px;margin-bottom:-1px;width:100%;text-align:left;background-color:#24292e\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"54\" height=\"14\" viewBox=\"0 0 54 14\"><g fill=\"none\" fill-rule=\"evenodd\" transform=\"translate(1 1)\"><circle cx=\"6\" cy=\"6\" r=\"6\" fill=\"#FF5F56\" stroke=\"#E0443E\" stroke-width=\".5\"><\/circle><circle cx=\"26\" cy=\"6\" r=\"6\" fill=\"#FFBD2E\" stroke=\"#DEA123\" stroke-width=\".5\"><\/circle><circle cx=\"46\" cy=\"6\" r=\"6\" fill=\"#27C93F\" stroke=\"#1AAB29\" stroke-width=\".5\"><\/circle><\/g><\/svg><\/span><span role=\"button\" tabindex=\"0\" style=\"color:#e1e4e8;display:none\" aria-label=\"Copy\" class=\"code-block-pro-copy-button\"><pre class=\"code-block-pro-copy-button-pre\" aria-hidden=\"true\"><textarea class=\"code-block-pro-copy-button-textarea\" tabindex=\"-1\" aria-hidden=\"true\" readonly>&lt;?php\n\/\/ Konceptualni prikaz onoga \u0161to je u analizi problemati\u010dno:\n\/\/ forma -&gt; mapiranje polja -&gt; $args -&gt; wp_insert_user($args)\n\n$args = [];\n\n\/\/ ... skupljanje vrijednosti iz forme u $args ...\n\/\/ (ako 'role' zavr\u0161i u $args bez server-side ograni\u010denja)\n\n$user_id = wp_insert_user($args);\n?&gt;\n<\/textarea><\/pre><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:24px;height:24px\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" stroke-width=\"2\"><path class=\"with-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2m-6 9l2 2 4-4\"><\/path><path class=\"without-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2\"><\/path><\/svg><\/span><pre class=\"shiki github-dark\" style=\"background-color:#24292e;color:#e1e4e8\" tabindex=\"0\"><code><span class=\"line\"><span style=\"color:#F97583\">&#x3C;?<\/span><span style=\"color:#79B8FF\">php<\/span><\/span>\n<span class=\"line\"><span style=\"color:#6A737D\">\/\/ Konceptualni prikaz onoga \u0161to je u analizi problemati\u010dno:<\/span><\/span>\n<span class=\"line\"><span style=\"color:#6A737D\">\/\/ forma -> mapiranje polja -> $args -> wp_insert_user($args)<\/span><\/span>\n<span class=\"line\"><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">$args <\/span><span style=\"color:#F97583\">=<\/span><span style=\"color:#E1E4E8\"> [];<\/span><\/span>\n<span class=\"line\"><\/span>\n<span class=\"line\"><span style=\"color:#6A737D\">\/\/ ... skupljanje vrijednosti iz forme u $args ...<\/span><\/span>\n<span class=\"line\"><span style=\"color:#6A737D\">\/\/ (ako 'role' zavr\u0161i u $args bez server-side ograni\u010denja)<\/span><\/span>\n<span class=\"line\"><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">$user_id <\/span><span style=\"color:#F97583\">=<\/span><span style=\"color:#B392F0\"> wp_insert_user<\/span><span style=\"color:#E1E4E8\">($args);<\/span><\/span>\n<span class=\"line\"><span style=\"color:#F97583\">?><\/span><\/span><\/code><\/pre><\/div>\n\n\n\n<p>Ovo je klasi\u010dan primjer gdje se previ\u0161e vjeruje klijentu (formi) ili konfiguraciji u administraciji, a premalo se radi <em>server-side validation<\/em> (provjera na serveru) prije nego \u0161to se pozove WordPress API za kreiranje korisnika.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Za\u0161to je ovo \u201eCritical\u201d (CVSS 9.8)<\/h2>\n\n\n\n<p>Jednom kad napada\u010d dobije administratorsku ulogu, prakti\u010dki ima punu kontrolu nad WordPress instalacijom: mo\u017ee instalirati pluginove\/teme, uploadati ZIP s backdoorom, mijenjati sadr\u017eaj, ubaciti redirecte, spam ili JavaScript injekcije, te si otvoriti trajni pristup.<\/p>\n\n\n\n<p>Zato ovakve ranjivosti gotovo uvijek treba tretirati kao potencijalnu potpunu kompromitaciju, \u010dak i kad je uvjet eksploatacije specifi\u010dan.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Koje su verzije pogo\u0111ene i \u0161to je zakrpano<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li>Plugin: Advanced Custom Fields: Extended (slug: <code>acf-extended<\/code>)<\/li>\n\n\n<li>Pogo\u0111ene verzije: sve do i uklju\u010duju\u0107i <strong>0.9.2.1<\/strong><\/li>\n\n\n<li>Zakrpljena verzija: <strong>0.9.2.2<\/strong><\/li>\n\n\n<li>CVE: <strong>CVE-2025-14533<\/strong><\/li>\n\n\n<li>Ocjena: <strong>CVSS 9.8 (Critical)<\/strong><\/li>\n\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Kako se za\u0161tititi (prakti\u010dno i bez filozofije)<\/h2>\n\n\n\n<ol class=\"wp-block-list\">\n\n<li>A\u017euriraj <strong>ACF Extended<\/strong> na <strong>0.9.2.2<\/strong> ili novije (\u0161to prije).<\/li>\n\n\n<li>Ako koristi\u0161 ACF Extended forme za registraciju: provjeri ima\u0161 li polje koje mapira <code>role<\/code> i ukloni ga iz javno dostupnih formi (ili ga barem privremeno isklju\u010di).<\/li>\n\n\n<li>Provjeri postoje li neo\u010dekivani admin korisnici kreirani u periodu izlo\u017eenosti (Users \u2192 All Users) i resetiraj lozinke\/klju\u010deve gdje ima smisla.<\/li>\n\n\n<li>Ako koristi\u0161 Wordfence: imaj na umu da su <strong>Premium\/Care\/Response<\/strong> korisnici dobili WAF pravilo 11.12.2025., a <strong>Free<\/strong> korisnici 10.01.2026. (prema objavi).<\/li>\n\n<\/ol>\n\n\n\n<div class=\"wp-block-group callout callout-info is-style-info is-layout-flow wp-block-group-is-layout-flow\" style=\"border-width:1px;border-radius:8px;padding-top:1rem;padding-right:1.5rem;padding-bottom:1rem;padding-left:1.5rem\">\n\n<h4 class=\"wp-block-heading callout-title\">Za developere: lekcija za custom forme<\/h4>\n\n\n<p>Ako radi\u0161 vlastiti registration flow (bilo kroz ACF Extended, bilo kroz custom endpoint), nikad se ne oslanjaj na UI ograni\u010denja polja. Uloge i capability-ji moraju biti ograni\u010deni na serveru, prije <code>wp_insert_user()<\/code> ili <code>wp_update_user()<\/code>.<\/p>\n\n<\/div>\n\n\n\n<h2 class=\"wp-block-heading\">\u0160to znamo o prijavi i vremenskoj liniji<\/h2>\n\n\n\n<p>Wordfence navodi da je ranjivost prijavljena kroz njihov Bug Bounty Program, validirana i proslije\u0111ena vendor timu kroz Wordfence Vulnerability Management Portal. Zakrpa je objavljena brzo, 14.12.2025., a firewall za\u0161tita je isporu\u010dena korisnicima Wordfencea prema njihovom modelu (Premium ranije, Free s odgodom).<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li>10.12.2025. \u2014 zaprimljena prijava ranjivosti<\/li>\n\n\n<li>11.12.2025. \u2014 potvr\u0111en proof-of-concept i isporu\u010deno WAF pravilo za Wordfence Premium\/Care\/Response<\/li>\n\n\n<li>11.12.2025. \u2014 detalji poslani vendor timu<\/li>\n\n\n<li>14.12.2025. \u2014 objavljena zakrpa (ACF Extended 0.9.2.2)<\/li>\n\n\n<li>10.01.2026. \u2014 WAF pravilo isporu\u010deno Wordfence Free korisnicima<\/li>\n\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Zaklju\u010dak<\/h2>\n\n\n\n<p>ACF Extended je popularan dodatak uz ACF, a ova ranjivost je dobar podsjetnik koliko su osjetljive forme koje kreiraju ili a\u017euriraju korisnike. Ako ti je na siteu igdje izlo\u017een \u201eCreate user\u201d\/\u201eUpdate user\u201d flow i postoji mogu\u0107nost da <code>role<\/code> zavr\u0161i u requestu, rizik je visok.<\/p>\n\n\n\n<p>Minimalna akcija je jasna: <strong>a\u017eurirati na 0.9.2.2<\/strong>, te pregledati forme i mapiranja kako <code>role<\/code> ne bi postao najkra\u0107i put do administratorskih privilegija.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"2560\" height=\"1600\" src=\"https:\/\/helloblog.io\/app\/uploads\/sites\/22\/2026\/01\/acfe-1-scaled-1.png\" alt=\"ACF Extended postavke polja za korisni\u010dku ulogu s opcijom ograni\u010denja (Allow User Role)\" class=\"wp-image-147\" srcset=\"https:\/\/helloblog.io\/app\/uploads\/sites\/22\/2026\/01\/acfe-1-scaled-1.png 2560w, https:\/\/helloblog.io\/app\/uploads\/sites\/22\/2026\/01\/acfe-1-scaled-1-300x188.png 300w, https:\/\/helloblog.io\/app\/uploads\/sites\/22\/2026\/01\/acfe-1-scaled-1-1024x640.png 1024w, https:\/\/helloblog.io\/app\/uploads\/sites\/22\/2026\/01\/acfe-1-scaled-1-768x480.png 768w, https:\/\/helloblog.io\/app\/uploads\/sites\/22\/2026\/01\/acfe-1-scaled-1-1536x960.png 1536w, https:\/\/helloblog.io\/app\/uploads\/sites\/22\/2026\/01\/acfe-1-scaled-1-2048x1280.png 2048w, https:\/\/helloblog.io\/app\/uploads\/sites\/22\/2026\/01\/acfe-1-scaled-1-400x250.png 400w\" sizes=\"auto, (max-width: 2560px) 100vw, 2560px\" \/><figcaption class=\"wp-element-caption\">U ACF Extended mogu\u0107e je ograni\u010diti uloge kroz postavke polja, ali ranjiva verzija nije primjenjivala o\u010dekivana ograni\u010denja na razini forme. \u2014 <em>Forr\u00e1s: Wordfence.com<\/em><\/figcaption><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"2560\" height=\"1599\" src=\"https:\/\/helloblog.io\/app\/uploads\/sites\/22\/2026\/01\/acfe-2-scaled-1.png\" alt=\"ACF Extended forma s akcijom za kreiranje korisnika i mapiranjem polja\" class=\"wp-image-148\" srcset=\"https:\/\/helloblog.io\/app\/uploads\/sites\/22\/2026\/01\/acfe-2-scaled-1.png 2560w, https:\/\/helloblog.io\/app\/uploads\/sites\/22\/2026\/01\/acfe-2-scaled-1-300x187.png 300w, https:\/\/helloblog.io\/app\/uploads\/sites\/22\/2026\/01\/acfe-2-scaled-1-1024x640.png 1024w, https:\/\/helloblog.io\/app\/uploads\/sites\/22\/2026\/01\/acfe-2-scaled-1-768x480.png 768w, https:\/\/helloblog.io\/app\/uploads\/sites\/22\/2026\/01\/acfe-2-scaled-1-1536x959.png 1536w, https:\/\/helloblog.io\/app\/uploads\/sites\/22\/2026\/01\/acfe-2-scaled-1-2048x1279.png 2048w, https:\/\/helloblog.io\/app\/uploads\/sites\/22\/2026\/01\/acfe-2-scaled-1-400x250.png 400w\" sizes=\"auto, (max-width: 2560px) 100vw, 2560px\" \/><figcaption class=\"wp-element-caption\">Problem nastaje kad forma mapira polje uloge (role) na akciju kreiranja korisnika bez server-side restrikcija. \u2014 <em>Forr\u00e1s: Wordfence.com<\/em><\/figcaption><\/figure>\n\n\n<div class=\"references-section\">\n                <h2>Reference \/ Izvori<\/h2>\n                <ul class=\"references-list\"><li><a href=\"https:\/\/www.wordfence.com\/blog\/2026\/01\/100000-wordpress-sites-affected-by-privilege-escalation-vulnerability-in-advanced-custom-fields-extended-wordpress-plugin\/\" target=\"_blank\" rel=\"noopener noreferrer\">100,000 WordPress Sites Affected by Privilege Escalation Vulnerability in Advanced Custom Fields: Extended WordPress Plugin<\/a><\/li><li><a href=\"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/acf-extended\/advanced-custom-fields-extended-0921-unauthenticated-privilege-escalation-via-insert-user-form-action\" target=\"_blank\" rel=\"noopener noreferrer\">Advanced Custom Fields: Extended &lt;= 0.9.2.1 &#8212; Unauthenticated Privilege Escalation via Insert User Form Action<\/a><\/li><li><a href=\"https:\/\/www.cve.org\/CVERecord?id=CVE-2025-14533\" target=\"_blank\" rel=\"noopener noreferrer\">CVE-2025-14533<\/a><\/li><li><a href=\"https:\/\/wordpress.org\/plugins\/acf-extended\/\" target=\"_blank\" rel=\"noopener noreferrer\">Advanced Custom Fields: Extended<\/a><\/li><\/ul>\n            <\/div>","protected":false},"excerpt":{"rendered":"<p>Ako koristi\u0161 Advanced Custom Fields: Extended (ACF Extended) i preko njega radi\u0161 registraciju korisnika, provjeri jednu stvar odmah: mapira\u0161 li polje `role` u formi. U kriti\u010dnom scenariju napada\u010d bez prijave mo\u017ee sebi dodijeliti administratorsku ulogu.<\/p>\n","protected":false},"author":43,"featured_media":146,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[9],"tags":[74,58,33,15,10],"class_list":["post-149","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-sigurnost","tag-acf-extended","tag-cve","tag-sigurnost","tag-wordfence","tag-wordpress"],"_links":{"self":[{"href":"https:\/\/helloblog.io\/hr\/wp-json\/wp\/v2\/posts\/149","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/helloblog.io\/hr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/helloblog.io\/hr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/helloblog.io\/hr\/wp-json\/wp\/v2\/users\/43"}],"replies":[{"embeddable":true,"href":"https:\/\/helloblog.io\/hr\/wp-json\/wp\/v2\/comments?post=149"}],"version-history":[{"count":0,"href":"https:\/\/helloblog.io\/hr\/wp-json\/wp\/v2\/posts\/149\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/helloblog.io\/hr\/wp-json\/wp\/v2\/media\/146"}],"wp:attachment":[{"href":"https:\/\/helloblog.io\/hr\/wp-json\/wp\/v2\/media?parent=149"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/helloblog.io\/hr\/wp-json\/wp\/v2\/categories?post=149"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/helloblog.io\/hr\/wp-json\/wp\/v2\/tags?post=149"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}