The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to privilege escalation in versions up to 0.9.2.1. The vulnerability exists in the 'insert_user' function which fails to restrict user registration roles. Unauthenticated attackers can exploit this by supplying the 'administrator' role during registration to gain full administrative access. The vulnerability requires that 'role' be mapped to a custom field to be exploitable. This represents a critical security flaw allowing complete compromise of WordPress sites using the affected plugin.