{
 "id": "WPSEC-2026-0802",
 "url": "https://wpsec.com/vuln/WPSEC-2026-0802/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-0802/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-0802/index.md",
 "title": "Frontend Admin by DynamiApps <= 3.29.13 - Unauthenticated Missing Authorization to ACF Options Update",
 "description": "The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to unauthorized modification of data via the options field group of form submissions in all versions up to, and including, 3.29.13, due to a missing capability check in the ActionOptions::run() function when saving ACF option field values. This makes it possible for unauthenticated attackers, on sites with a publicly available form, to change values of ACF options page fields site-wide.",
 "plugin": {
  "slug": "acf-frontend-form-element",
  "name": "Frontend Admin by DynamiApps",
  "full_name": "Frontend Admin by DynamiApps",
  "wordpress_org": "https://wordpress.org/plugins/acf-frontend-form-element/",
  "advisories_url": "https://wpsec.com/vuln/plugin/acf-frontend-form-element/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/acf-frontend-form-element"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "3.30.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 3.30.0"
  ]
 },
 "introduced_in": null,
 "fixed_in": "3.30.0",
 "remediation": "Update to 3.30.0 or later.",
 "fix_released": "2026-10-08T11:29:58+00:00",
 "published": "2026-10-12T12:53:32+00:00",
 "updated": "2026-10-12T11:57:20.879498+00:00",
 "also_published_as": {
  "source": null,
  "cve": [
   "CVE-2026-81343"
  ],
  "published": "2026-10-15T10:08:00+00:00"
 },
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-0802/",
  "https://plugins.svn.wordpress.org/acf-frontend-form-element/tags/3.30.0/",
  "https://wordpress.org/plugins/acf-frontend-form-element/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/acf-frontend-form-element",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-12"
 }
}