Frontend Admin CVE-2026-109892

Requires the target site to run the Frontend Admin by DynamiApps (acf-frontend-form-element) plugin at version 3.29.13 or earlier with a Frontend Admin form (e.g. user registration or profile-edit form) published and reachable by the attacker. The core precondition is the ability to submit that form so the plugin performs its incorrect privilege assignment; the key limiting factor is whether such a form is exposed to fully unauthenticated visitors (supporting PR:N) or only to logged-in low-privilege users (which would require a subscriber-level account first). No user interaction by an administrator is needed, and no non-default server configuration is implied beyond having the plugin active with a privilege-affecting form in use.

The input assigns CVSS 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), which on its face describes a network-reachable, unauthenticated, low-complexity privilege escalation with total confidentiality, integrity, and availability impact - on WordPress, successful admin-role escalation effectively means full site compromise. However, the signals partially conflict: the weakness is CWE-266 Incorrect Privilege Assignment manifesting as privilege escalation, and such flaws in form-handling plugins typically require the attacker to be able to submit the registration/profile form, which often implies at least a low-privilege (subscriber) account - tension with the PR:N in the supplied vector. Verify with the vendor/Patchstack whether the vulnerable form is exposed to fully unauthenticated visitors or only to logged-in low-privilege users. On exploitation likelihood, no EPSS score, no CISA KEV listing, and no public exploit were provided; this is 'no public exploit identified at time of analysis,' so despite the 9.8 this is not confirmed to be under active or widespread exploitation. Net: treat as a high-priority patch item because the impact (admin takeover) is severe and the product is internet-facing, but the absence of KEV/EPSS/POC means prioritization rests on impact and reachability rather than on evidence of in-the-wild abuse.

An attacker interacts with a public Frontend Admin form (such as a user-registration or profile-edit form) on a WordPress site running the plugin at or below 3.29.13 and manipulates the submitted data so the plugin assigns their account an elevated role. Because the issue is incorrect privilege assignment, the attacker ends up with administrator-level capabilities and can then take over the site. No public exploit code was identified in the provided data, and the low attack complexity (AC:L) means no special timing or race conditions are needed.