# Frontend Admin by DynamiApps <= 3.29.13 - Unauthenticated Arbitrary Post Type Creation and Status Change via Post Type and Post Status Fields

- **ID:** WPSEC-2026-0789
- **Plugin:** Frontend Admin by DynamiApps (`acf-frontend-form-element`), https://wordpress.org/plugins/acf-frontend-form-element/
- **Affected versions:** all versions before 3.30.0
- **Fixed in:** 3.30.0 (Update to 3.30.0 or later.)
- **Severity:** Low 3.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-12)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/acf-frontend-form-element
- **Fix released:** 2026-10-08
- **Published:** 2026-10-12
- **URL:** https://wpsec.com/vuln/WPSEC-2026-0789/

## Description

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to unauthorized post type creation and post status changes via the Post Type and Post Status form fields in all versions up to, and including, 3.29.13. This is due to the plugin using the submitted Post Type and Post Status values when saving a post without checking them against the options the field offers, and without restricting internal post types to administrators. This makes it possible for unauthenticated attackers, on sites with a publicly available post submission form that includes a Post Type or Post Status field, to create posts of internal types such as ACF field definitions and plugin form definitions, and to give their submissions any status, for example publishing content the form would hold for review.

## References

- https://wpsec.com/vuln/WPSEC-2026-0789/
- https://plugins.svn.wordpress.org/acf-frontend-form-element/tags/3.30.0/
- https://wordpress.org/plugins/acf-frontend-form-element/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-0789/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.