# ACF Frontend Admin by DynamiApps <= 3.30.1 - Unauthenticated Insecure Direct Object Reference to Arbitrary Post and Attachment Modification

- **ID:** WPSEC-2026-2251
- **Plugin:** ACF Frontend Admin by DynamiApps (`acf-frontend-form-element`), https://wordpress.org/plugins/acf-frontend-form-element/
- **Affected versions:** all versions before 3.30.2
- **Fixed in:** 3.30.2 (Update to 3.30.2 or later.)
- **Severity:** Medium 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L)
- **Weakness:** CWE-639
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-03)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/acf-frontend-form-element
- **Fix released:** 2026-11-01
- **Published:** 2026-11-03
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2251/

## Description

The ACF Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Insecure Direct Object Reference via the file, image and gallery form fields and the 'acf/fields/upload_file/update_meta' AJAX action in all versions up to, and including, 3.30.1. This is due to missing validation on the user-supplied ID submitted as the field value or attach_id: the plugin does not check that it is an attachment the visitor uploaded or may edit. This makes it possible for unauthenticated attackers to overwrite the title, content and excerpt of arbitrary posts, pages and attachments, change attachment alt text, regenerate attachment metadata, and move attachment files to a different uploads folder.

## References

- https://wpsec.com/vuln/WPSEC-2026-2251/
- https://plugins.svn.wordpress.org/acf-frontend-form-element/tags/3.30.2/
- https://wordpress.org/plugins/acf-frontend-form-element/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2251/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.