{"id":129,"date":"2026-01-19T00:00:00","date_gmt":"2026-01-18T23:00:00","guid":{"rendered":"https:\/\/helloblog.io\/lt\/kritine-privilegiju-eskalavimo-spraga-acf-extended-ka-daryti\/"},"modified":"2026-01-19T00:00:00","modified_gmt":"2026-01-18T23:00:00","slug":"kritine-privilegiju-eskalavimo-spraga-acf-extended-ka-daryti","status":"publish","type":"post","link":"https:\/\/helloblog.io\/lt\/kritine-privilegiju-eskalavimo-spraga-acf-extended-ka-daryti\/","title":{"rendered":"Kritin\u0117 privilegij\u0173 eskalavimo spraga \u201eACF Extended\u201c: kada rizika reali ir k\u0105 daryti dabar"},"content":{"rendered":"\n<p>WordPress formos yra patogus b\u016bdas automatizuoti vartotoj\u0173 registracij\u0105 ar profilio atnaujinim\u0105, ypa\u010d kai naudoji ACF ekosistem\u0105. Ta\u010diau kai forma leid\u017eia vartotojui valdyti tai, kas tur\u0117t\u0173 b\u016bti grie\u017etai kontroliuojama (pvz., rol\u0117s), vienas netikslus patikrinimas tampa tiesioginiu keliu \u012f piln\u0105 svetain\u0117s per\u0117mim\u0105.<\/p>\n\n\n\n<p>\u201eWordfence\u201c komanda paskelb\u0117 apie kritin\u0119 privilegij\u0173 eskalavimo sprag\u0105 \u201eAdvanced Custom Fields: Extended\u201c (plugin slug: <code>acf-extended<\/code>). \u012eskiepis turi vir\u0161 100 000 aktyvi\u0173 diegim\u0173, o pa\u017eeid\u017eiamumas \u012fvertintas <strong>CVSS 9.8 (Critical)<\/strong> ir jam priskirtas <strong>CVE-2025-14533<\/strong>.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Kas pa\u017eeid\u017eiama ir kod\u0117l tai svarbu<\/h2>\n\n\n\n<p>Kalbame apie <strong>privilegij\u0173 eskalavim\u0105<\/strong> (Privilege Escalation) \u2014 situacij\u0105, kai atakuotojas gauna daugiau teisi\u0173 nei tur\u0117t\u0173. \u0160iuo atveju svarbiausia detal\u0117: pagal \u201eWordfence\u201c analiz\u0119, <strong>neautentifikuotas<\/strong> (t. y. neprisijung\u0119s) naudotojas gal\u0117jo susikurti paskyr\u0105 su <strong>administratoriaus<\/strong> role, jei svetain\u0117je buvo sukonfig\u016bruota tam tikra \u201eACF Extended\u201c forma.<\/p>\n\n\n\n<p>Pa\u017eeid\u017eiamumas paveik\u0117 \u201eAdvanced Custom Fields: Extended\u201c versijas <strong>iki 0.9.2.1 imtinai<\/strong>. Pataisyta versijoje <strong>0.9.2.2<\/strong>.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Kada spraga realiai i\u0161naudojama (svarbus niuansas)<\/h2>\n\n\n\n<p>\u0160i istorija n\u0117ra \u201e\u012fjungiau \u012fskiep\u012f ir mane nulau\u017e\u0117\u201c. Kritin\u0117 rizika atsiranda tada, kai svetain\u0117s savininkas (ar projektuotojas):<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li>\u201eACF Extended\u201c sukuria form\u0105 su veiksmais \u201eCreate user\u201c arba \u201eUpdate user\u201c (vartotojo suk\u016brimas \/ atnaujinimas).<\/li>\n\n\n<li>\u012e form\u0105 \u012ftraukia lauk\u0105, kuris map\u2019inamas (priri\u0161amas) prie vartotojo rol\u0117s (<code>role<\/code>).<\/li>\n\n\n<li>Forma pasiekiama neautentifikuotiems lankytojams (pvz., registracijos forma vie\u0161ame puslapyje).<\/li>\n\n<\/ul>\n\n\n\n<div class=\"wp-block-group callout callout-warning is-style-warning is-layout-flow wp-block-group-is-layout-flow\" style=\"border-width:1px;border-radius:8px;padding-top:1rem;padding-right:1.5rem;padding-bottom:1rem;padding-left:1.5rem\">\n\n<h4 class=\"wp-block-heading callout-title\">Kod\u0117l tai svarbu<\/h4>\n\n\n<p>Pagal \u201eWordfence\u201c apra\u0161ym\u0105, pa\u017eeid\u017eiamumas pasirei\u0161kia tik tada, kai <code>role<\/code> yra map\u2019inama \u012f custom field. Jei jokio rol\u0117s lauko formoje n\u0117ra, atakos vektorius dingsta.<\/p>\n\n<\/div>\n\n\n\n<h2 class=\"wp-block-heading\">Kaip tai veik\u0117 techni\u0161kai<\/h2>\n\n\n\n<p>\u201eACF Extended\u201c turi form\u0173 modul\u012f, leid\u017eiant\u012f sukonstruoti vartotojo registracijos form\u0105 i\u0161 ACF lauk\u0173 grup\u0117s. \u201eWordfence\u201c aptiko, kad klas\u0117je <code>acfe_module_form_action_user<\/code> naudojama funkcija <code>insert_user()<\/code> formuoja argumentus ir kvie\u010dia <code>wp_insert_user($args)<\/code>.<\/p>\n\n\n\n<p>Problema \u2014 <strong>rol\u0117s apribojimai, kurie logi\u0161kai tur\u0117t\u0173 b\u016bti taikomi rol\u0117s laukui (\u201eAllow User Role\u201c nustatymas), nebuvo pritaikomi formos veiksmui<\/strong>. D\u0117l to atakuotojas gal\u0117jo pateikti <code>role=administrator<\/code> (ar kit\u0105 privilegijuot\u0105 rol\u0119) net jei UI lygmenyje atrod\u0117, kad rol\u0117 ribojama.<\/p>\n\n\n\n<div class=\"wp-block-group callout callout-info is-style-info is-layout-flow wp-block-group-is-layout-flow\" style=\"border-width:1px;border-radius:8px;padding-top:1rem;padding-right:1.5rem;padding-bottom:1rem;padding-left:1.5rem\">\n\n<h4 class=\"wp-block-heading callout-title\">Praktinis scenarijus<\/h4>\n\n\n<p>Jei tavo registracijos forma siun\u010dia laukus \u012f \u201eCreate user\u201c veiksm\u0105 ir vienas i\u0161 lauk\u0173 yra <code>role<\/code>, atakuotojui u\u017etenka pakeisti POST reik\u0161m\u0119 (pvz., per DevTools ar tiesiogin\u0119 u\u017eklaus\u0105) ir nurodyti <code>administrator<\/code>.<\/p>\n\n<\/div>\n\n\n\n<h2 class=\"wp-block-heading\">K\u0105 gali padaryti atakuotojas gav\u0119s admin teises<\/h2>\n\n\n\n<p>Kai u\u017epuolikas turi administratoriaus rol\u0119 WordPress\u2019e, tai i\u0161 esm\u0117s yra pilnas svetain\u0117s per\u0117mimas: galima \u012fkelti \u012fskiepius ar temas (\u012fskaitant kenk\u0117ji\u0161kus ZIP su backdoor), keisti puslapius ir \u012fra\u0161us (pvz., \u012fterpti spam, SEO \u0161lam\u0161t\u0105, peradresavimus), koreguoti nustatymus ir vartotoj\u0173 teises.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">K\u0105 daryti: konkret\u016bs \u017eingsniai (dev\/ops check-list)<\/h2>\n\n\n\n<ol class=\"wp-block-list\">\n\n<li>Atnaujink \u201eAdvanced Custom Fields: Extended\u201c \u012f <strong>0.9.2.2<\/strong> arba naujesn\u0119 versij\u0105 (tai yra pataisyta versija, minima \u201eWordfence\u201c prane\u0161ime).<\/li>\n\n\n<li>Surask, ar svetain\u0117je i\u0161vis naudojamos \u201eACF Extended\u201c formos su \u201eCreate user\u201c \/ \u201eUpdate user\u201c veiksmais. Jei taip \u2014 patikrink, ar \u012f form\u0105 map\u2019inamas <code>role<\/code> laukas.<\/li>\n\n\n<li>Jei <code>role<\/code> laukas b\u016btinas (retas atvejis), laikinai pa\u0161alink j\u012f i\u0161 vie\u0161ai pasiekiam\u0173 form\u0173 arba apribok prieig\u0105 (pvz., kad forma b\u016bt\u0173 prieinama tik prisijungusiems \/ tik konkre\u010diam vaidmeniui).<\/li>\n\n\n<li>Per\u017ei\u016br\u0117k vartotoj\u0173 s\u0105ra\u0161\u0105: ar n\u0117ra \u012ftartin\u0173 naujai sukurt\u0173 administratori\u0173. Ypa\u010d atkreipk d\u0117mes\u012f \u012f paskyras be \u012fprast\u0173 profilio duomen\u0173 arba su keistais el. pa\u0161to domenais.<\/li>\n\n\n<li>Jei naudoji WAF (web application firewall) \u2014 \u012fsitikink, kad taisykl\u0117s atnaujintos. \u201eWordfence\u201c nurod\u0117, kad j\u0173 firewall taisykl\u0117 buvo i\u0161leista mokamiems klientams anks\u010diau, o nemokamai versijai v\u0117liau (detal\u0117s \u017eemiau).<\/li>\n\n<\/ol>\n\n\n\n<h2 class=\"wp-block-heading\">Wordfence apsauga ir laiko juosta (pagal prane\u0161im\u0105)<\/h2>\n\n\n\n<p>Pagal \u201eWordfence\u201c publikacij\u0105, procesas atrod\u0117 taip:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li>2025-12-10 gautas prane\u0161imas per \u201eWordfence Bug Bounty Program\u201c (tyr\u0117jas: andrea bocchetti).<\/li>\n\n\n<li>2025-12-11 patvirtintas pa\u017eeid\u017eiamumas ir proof-of-concept; tuo pa\u010diu metu tiek\u0117jui pateikta informacija per \u201eWordfence Vulnerability Management Portal\u201c.<\/li>\n\n\n<li>2025-12-11 \u201eWordfence Premium\/Care\/Response\u201c gavo firewall taisykl\u0119, kuri padeda blokuoti bandymus i\u0161naudoti sprag\u0105.<\/li>\n\n\n<li>2025-12-14 i\u0161leista pataisyta \u201eACF Extended\u201c versija <strong>0.9.2.2<\/strong>.<\/li>\n\n\n<li>2026-01-10 analogi\u0161ka apsauga pasiek\u0117 \u201eWordfence Free\u201c naudotojus.<\/li>\n\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Kod\u0117l \u0161i pamoka svarbi net jei nenaudoji ACF Extended form\u0173<\/h2>\n\n\n\n<p>Tai klasikinis pavyzdys, kai UI nustatymas (pvz., \u201eAllow User Role\u201c) sukuria saugumo jausm\u0105, bet reali kontrol\u0117 turi b\u016bti \u012fgyvendinta serverio pus\u0117je. Jei kuri registracijos \/ profilio formas (nesvarbu, ar per ACF, ar per custom kod\u0105), taisykl\u0117 paprasta: <strong>niekada nepasitik\u0117k role\/capability reik\u0161m\u0117mis, ateinan\u010diomis i\u0161 kliento<\/strong>. Rol\u0117s turi b\u016bti nustatomos pagal serverio logik\u0105, o ne pagal formos lauk\u0105.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Santrauka<\/h2>\n\n\n\n<p>\u201eAdvanced Custom Fields: Extended\u201c pa\u017eeid\u017eiamumas (CVE-2025-14533, CVSS 9.8) leido neautentifikuotam atakuotojui gauti administratoriaus rol\u0119, jei svetain\u0117je buvo vie\u0161ai pasiekiama vartotojo k\u016brimo\/atnaujinimo forma su map\u2019inamu <code>role<\/code> lauku. Pataisymas i\u0161leistas versijoje <strong>0.9.2.2<\/strong>, tod\u0117l realus veiksmas Nr. 1 \u2014 atnaujinti \u012fskiep\u012f ir per\u017ei\u016br\u0117ti form\u0173 konfig\u016bracij\u0105 bei vartotoj\u0173 s\u0105ra\u0161\u0105.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"2560\" height=\"1600\" src=\"https:\/\/helloblog.io\/app\/uploads\/sites\/20\/2026\/01\/acfe-1-scaled-1.png\" alt=\"ACF Extended rol\u0117s lauko nustatymai (Allow User Role)\" class=\"wp-image-127\" srcset=\"https:\/\/helloblog.io\/app\/uploads\/sites\/20\/2026\/01\/acfe-1-scaled-1.png 2560w, https:\/\/helloblog.io\/app\/uploads\/sites\/20\/2026\/01\/acfe-1-scaled-1-300x188.png 300w, https:\/\/helloblog.io\/app\/uploads\/sites\/20\/2026\/01\/acfe-1-scaled-1-1024x640.png 1024w, https:\/\/helloblog.io\/app\/uploads\/sites\/20\/2026\/01\/acfe-1-scaled-1-768x480.png 768w, https:\/\/helloblog.io\/app\/uploads\/sites\/20\/2026\/01\/acfe-1-scaled-1-1536x960.png 1536w, https:\/\/helloblog.io\/app\/uploads\/sites\/20\/2026\/01\/acfe-1-scaled-1-2048x1280.png 2048w, https:\/\/helloblog.io\/app\/uploads\/sites\/20\/2026\/01\/acfe-1-scaled-1-400x250.png 400w\" sizes=\"auto, (max-width: 2560px) 100vw, 2560px\" \/><figcaption class=\"wp-element-caption\">Rol\u0117s laukas ACF lauk\u0173 grup\u0117je gali tur\u0117ti apribojimus, ta\u010diau pa\u017eeid\u017eiamoje versijoje formos veiksmas j\u0173 nepritaik\u0117. \u2014 <em>Forr\u00e1s: Wordfence.com<\/em><\/figcaption><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"2560\" height=\"1599\" src=\"https:\/\/helloblog.io\/app\/uploads\/sites\/20\/2026\/01\/acfe-2-scaled-1.png\" alt=\"ACF Extended formos veiksmas \u201eCreate user\u201c su lauk\u0173 map\u2019inimu\" class=\"wp-image-128\" srcset=\"https:\/\/helloblog.io\/app\/uploads\/sites\/20\/2026\/01\/acfe-2-scaled-1.png 2560w, https:\/\/helloblog.io\/app\/uploads\/sites\/20\/2026\/01\/acfe-2-scaled-1-300x187.png 300w, https:\/\/helloblog.io\/app\/uploads\/sites\/20\/2026\/01\/acfe-2-scaled-1-1024x640.png 1024w, https:\/\/helloblog.io\/app\/uploads\/sites\/20\/2026\/01\/acfe-2-scaled-1-768x480.png 768w, https:\/\/helloblog.io\/app\/uploads\/sites\/20\/2026\/01\/acfe-2-scaled-1-1536x959.png 1536w, https:\/\/helloblog.io\/app\/uploads\/sites\/20\/2026\/01\/acfe-2-scaled-1-2048x1279.png 2048w, https:\/\/helloblog.io\/app\/uploads\/sites\/20\/2026\/01\/acfe-2-scaled-1-400x250.png 400w\" sizes=\"auto, (max-width: 2560px) 100vw, 2560px\" \/><figcaption class=\"wp-element-caption\">Forma su \u201eCreate user\u201c veiksmu ir lauk\u0173 susiejimu (mapping) \u2014 kritin\u0117 kombinacija, jei map\u2019inamas ir <code>role<\/code> laukas. \u2014 <em>Forr\u00e1s: Wordfence.com<\/em><\/figcaption><\/figure>\n\n\n<div class=\"references-section\">\n                <h2>Nuorodos \/ \u0160altiniai<\/h2>\n                <ul class=\"references-list\"><li><a href=\"https:\/\/www.wordfence.com\/blog\/2026\/01\/100000-wordpress-sites-affected-by-privilege-escalation-vulnerability-in-advanced-custom-fields-extended-wordpress-plugin\/\" target=\"_blank\" rel=\"noopener noreferrer\">100,000 WordPress Sites Affected by Privilege Escalation Vulnerability in Advanced Custom Fields: Extended WordPress Plugin<\/a><\/li><li><a href=\"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/acf-extended\/advanced-custom-fields-extended-0921-unauthenticated-privilege-escalation-via-insert-user-form-action\" target=\"_blank\" rel=\"noopener noreferrer\">Advanced Custom Fields: Extended &lt;= 0.9.2.1 &#8212; Unauthenticated Privilege Escalation via Insert User Form Action<\/a><\/li><li><a href=\"https:\/\/www.cve.org\/CVERecord?id=CVE-2025-14533\" target=\"_blank\" rel=\"noopener noreferrer\">CVE-2025-14533<\/a><\/li><li><a href=\"https:\/\/wordpress.org\/plugins\/acf-extended\/\" target=\"_blank\" rel=\"noopener noreferrer\">Advanced Custom Fields: Extended<\/a><\/li><li><a href=\"https:\/\/www.wordfence.com\/threat-intel\/bug-bounty-program\/\" target=\"_blank\" rel=\"noopener noreferrer\">Wordfence Bug Bounty Program<\/a><\/li><li><a href=\"https:\/\/www.wordfence.com\/threat-intel\/vendor\/vulnerability-management-portal\/\" target=\"_blank\" rel=\"noopener noreferrer\">Wordfence Vulnerability Management Portal<\/a><\/li><\/ul>\n            <\/div>","protected":false},"excerpt":{"rendered":"<p>\u201eAdvanced Custom Fields: Extended\u201c tur\u0117jo kritin\u0119 sprag\u0105, leid\u017eian\u010di\u0105 neautentifikuotam vartotojui tapti administratoriumi \u2014 bet tik tam tikroje, gana konkre\u010dioje form\u0173 konfig\u016bracijoje. Pa\u017ei\u016br\u0117kime, kaip ji veik\u0117, kam ji aktuali ir kaip greitai susitvarkyti.<\/p>\n","protected":false},"author":55,"featured_media":126,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[9],"tags":[79,80,11,15,10],"class_list":["post-129","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-saugumas","tag-acf-extended","tag-cve","tag-saugumas","tag-wordfence","tag-wordpress"],"_links":{"self":[{"href":"https:\/\/helloblog.io\/lt\/wp-json\/wp\/v2\/posts\/129","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/helloblog.io\/lt\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/helloblog.io\/lt\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/helloblog.io\/lt\/wp-json\/wp\/v2\/users\/55"}],"replies":[{"embeddable":true,"href":"https:\/\/helloblog.io\/lt\/wp-json\/wp\/v2\/comments?post=129"}],"version-history":[{"count":0,"href":"https:\/\/helloblog.io\/lt\/wp-json\/wp\/v2\/posts\/129\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/helloblog.io\/lt\/wp-json\/wp\/v2\/media\/126"}],"wp:attachment":[{"href":"https:\/\/helloblog.io\/lt\/wp-json\/wp\/v2\/media?parent=129"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/helloblog.io\/lt\/wp-json\/wp\/v2\/categories?post=129"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/helloblog.io\/lt\/wp-json\/wp\/v2\/tags?post=129"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}