Frontend Admin by DynamiApps <= 3.29.13 - Unauthenticated Arbitrary Post Type Creation and Status Change via Post Type and Post Status Fields
- ID
- WPSEC-2026-0789
- Plugin
- Frontend Admin by DynamiApps (acf-frontend-form-element)
- Affected
- all versions before 3.30.0
- Remediation
- Update to 3.30.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-12
- Attack surface
- Frontend Admin by DynamiApps on WPSec AttackSurface
- Fix released
- Published
Description
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to unauthorized post type creation and post status changes via the Post Type and Post Status form fields in all versions up to, and including, 3.29.13. This is due to the plugin using the submitted Post Type and Post Status values when saving a post without checking them against the options the field offers, and without restricting internal post types to administrators. This makes it possible for unauthenticated attackers, on sites with a publicly available post submission form that includes a Post Type or Post Status field, to create posts of internal types such as ACF field definitions and plugin form definitions, and to give their submissions any status, for example publishing content the form would hold for review.
References
- https://wpsec.com/vuln/WPSEC-2026-0789/
- https://plugins.svn.wordpress.org/acf-frontend-form-element/tags/3.30.0/
- https://wordpress.org/plugins/acf-frontend-form-element/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS