ACF Frontend Admin by DynamiApps <= 3.30.1 - Unauthenticated Insecure Direct Object Reference to Arbitrary Post and Attachment Modification
- ID
- WPSEC-2026-2251
- Plugin
- ACF Frontend Admin by DynamiApps (acf-frontend-form-element)
- Affected
- all versions before 3.30.2
- Remediation
- Update to 3.30.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
- Weakness
- CWE-639
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-03
- Attack surface
- ACF Frontend Admin by DynamiApps on WPSec AttackSurface
- Fix released
- Published
Description
The ACF Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Insecure Direct Object Reference via the file, image and gallery form fields and the 'acf/fields/upload_file/update_meta' AJAX action in all versions up to, and including, 3.30.1. This is due to missing validation on the user-supplied ID submitted as the field value or attach_id: the plugin does not check that it is an attachment the visitor uploaded or may edit. This makes it possible for unauthenticated attackers to overwrite the title, content and excerpt of arbitrary posts, pages and attachments, change attachment alt text, regenerate attachment metadata, and move attachment files to a different uploads folder.
References
- https://wpsec.com/vuln/WPSEC-2026-2251/
- https://plugins.svn.wordpress.org/acf-frontend-form-element/tags/3.30.2/
- https://wordpress.org/plugins/acf-frontend-form-element/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS