Vulnerabilities / Frontend Admin by DynamiApps / WPSEC-2026-0802
Frontend Admin by DynamiApps <= 3.29.13 - Unauthenticated Missing Authorization to ACF Options Update
Medium 5.3
CWE-862Fixed in 3.30.0
- ID
- WPSEC-2026-0802
- Plugin
- Frontend Admin by DynamiApps (acf-frontend-form-element)
- Affected
- all versions before 3.30.0
- Remediation
- Update to 3.30.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-12
- Attack surface
- Frontend Admin by DynamiApps on WPSec AttackSurface
- Fix released
- Published
Also published later by Another source as CVE-2026-81343, on 2026-10-15.
Description
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to unauthorized modification of data via the options field group of form submissions in all versions up to, and including, 3.29.13, due to a missing capability check in the ActionOptions::run() function when saving ACF option field values. This makes it possible for unauthenticated attackers, on sites with a publicly available form, to change values of ACF options page fields site-wide.
References
- https://wpsec.com/vuln/WPSEC-2026-0802/
- https://plugins.svn.wordpress.org/acf-frontend-form-element/tags/3.30.0/
- https://wordpress.org/plugins/acf-frontend-form-element/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS