Unauthenticated administrator account creation via validation bypass

Privilege escalation in Advanced Custom Fields: Extended 0 through 0.9.2.5 allows remote attackers to create administrator accounts. The after_validate_save_post() function trusts the attacker-controlled _acf_post_id parameter to select a cleanup branch that discards validation errors lacking the acfe: prefix, including role restrictions. Exploitation requires a public ACFE frontend form with a Create User action that maps a role field; no prior account or user interaction is required.