ACF Frontend Admin by DynamiApps <= 3.30.1 - Unauthenticated Limited File Upload via File Upload Field
- ID
- WPSEC-2026-2252
- Plugin
- ACF Frontend Admin by DynamiApps (acf-frontend-form-element)
- Affected
- all versions before 3.30.2
- Remediation
- Update to 3.30.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-434
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-03
- Attack surface
- ACF Frontend Admin by DynamiApps on WPSec AttackSurface
- Fix released
- Published
Description
The ACF Frontend Admin by DynamiApps plugin for WordPress is vulnerable to limited file uploads via the 'acf/fields/upload_file/add_attachment' AJAX action in all versions up to, and including, 3.30.1. This is due to the file type check in validate_attachment() only running when the uploaded file name has an extension, so a file without an extension skips the allowed type check. The upload folder was also served without an X-Content-Type-Options: nosniff header. This makes it possible for unauthenticated attackers to upload files without an extension to the public fea-submissions uploads folder when a form with a file field is shown on the site. On servers that send such files without a content type, browsers may render them as HTML, which can lead to stored cross-site scripting.
References
- https://wpsec.com/vuln/WPSEC-2026-2252/
- https://plugins.svn.wordpress.org/acf-frontend-form-element/tags/3.30.2/
- https://wordpress.org/plugins/acf-frontend-form-element/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS