{
 "id": "WPSEC-2026-0789",
 "url": "https://wpsec.com/vuln/WPSEC-2026-0789/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-0789/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-0789/index.md",
 "title": "Frontend Admin by DynamiApps <= 3.29.13 - Unauthenticated Arbitrary Post Type Creation and Status Change via Post Type and Post Status Fields",
 "description": "The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to unauthorized post type creation and post status changes via the Post Type and Post Status form fields in all versions up to, and including, 3.29.13. This is due to the plugin using the submitted Post Type and Post Status values when saving a post without checking them against the options the field offers, and without restricting internal post types to administrators. This makes it possible for unauthenticated attackers, on sites with a publicly available post submission form that includes a Post Type or Post Status field, to create posts of internal types such as ACF field definitions and plugin form definitions, and to give their submissions any status, for example publishing content the form would hold for review.",
 "plugin": {
  "slug": "acf-frontend-form-element",
  "name": "Frontend Admin by DynamiApps",
  "full_name": "Frontend Admin by DynamiApps",
  "wordpress_org": "https://wordpress.org/plugins/acf-frontend-form-element/",
  "advisories_url": "https://wpsec.com/vuln/plugin/acf-frontend-form-element/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/acf-frontend-form-element"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 3.7,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Low"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "3.30.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 3.30.0"
  ]
 },
 "introduced_in": null,
 "fixed_in": "3.30.0",
 "remediation": "Update to 3.30.0 or later.",
 "fix_released": "2026-10-08T11:29:58+00:00",
 "published": "2026-10-12T11:49:14+00:00",
 "updated": "2026-10-12T11:06:29.564981+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-0789/",
  "https://plugins.svn.wordpress.org/acf-frontend-form-element/tags/3.30.0/",
  "https://wordpress.org/plugins/acf-frontend-form-element/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/acf-frontend-form-element",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-12"
 }
}