# Frontend Admin by DynamiApps <= 3.29.13 - Unauthenticated Missing Authorization to ACF Options Update

- **ID:** WPSEC-2026-0802
- **Plugin:** Frontend Admin by DynamiApps (`acf-frontend-form-element`), https://wordpress.org/plugins/acf-frontend-form-element/
- **Affected versions:** all versions before 3.30.0
- **Fixed in:** 3.30.0 (Update to 3.30.0 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-12)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/acf-frontend-form-element
- **Fix released:** 2026-10-08
- **Published:** 2026-10-12
- **URL:** https://wpsec.com/vuln/WPSEC-2026-0802/

## Description

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to unauthorized modification of data via the options field group of form submissions in all versions up to, and including, 3.29.13, due to a missing capability check in the ActionOptions::run() function when saving ACF option field values. This makes it possible for unauthenticated attackers, on sites with a publicly available form, to change values of ACF options page fields site-wide.

Also published later by another source as CVE-2026-81343.

## References

- https://wpsec.com/vuln/WPSEC-2026-0802/
- https://plugins.svn.wordpress.org/acf-frontend-form-element/tags/3.30.0/
- https://wordpress.org/plugins/acf-frontend-form-element/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-0802/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.