What is the CVSS score of CVE-2026-6226?

CVE-2026-6226 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Frontend Admin are affected by CVE-2026-6226?

Organizations using the Frontend Admin by DynamiApps WordPress plugin (versions ≤3.29.2) face critical risk: the plugin permits any internet-connected attacker to create administrator accounts…

How to fix or mitigate CVE-2026-6226?

Within 24 hours: Inventory all WordPress installations using Frontend Admin by DynamiApps; immediately disable the plugin on all instances running version 3.29.2 or earlier. Within 7 days: Audit WordPress admin account creation logs since plugin installation for unauthorized accounts; request security advisory and patched version timeline from DynamiApps. Within 30 days: Deploy vendor-released patched version once available, or migrate to alternative form-building plugin and decommission vulnerable version.

Frontend Admin CVE-2026-6226

EUVD-2026-32749 HIGH

Improper Privilege Management (CWE-269)

2026-05-28 Wordfence

GHSA-mfvv-f9h5-2mqr

WordPress Privilege Escalation Frontend Admin By Dynamiapps Wordpress Plugin Shabti

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 28, 2026 - 09:21 vuln.today

CVE Published

May 28, 2026 - 08:27 nvd

HIGH 8.8

DescriptionCVE.org

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to unauthenticated privilege escalation in versions up to and including 3.29.2. This is due to insecure form submission handling that accepts arbitrary form definitions from user input instead of securely loading them from the backend. When $_POST['_acf_form'] is an array (rather than a form ID), the validate_form() function bypasses database lookup and directly processes the attacker-controlled structure. The create_record() function preserves attacker-supplied record data if present, and the user action's run() function falls back to attacker-controlled field definitions from $form['fields'] when legitimate fields cannot be found. The role field's pre_update_value() validation reads $field['role_options'] from this attacker-controlled definition, allowing an attacker to specify ['administrator'] as an allowed role and bypass the security check. This makes it possible for unauthenticated attackers to create administrator accounts by injecting a custom form configuration with a spoofed role field.

AnalysisAI

Unauthenticated privilege escalation in the Frontend Admin by DynamiApps WordPress plugin (versions up to and including 3.29.2) allows remote attackers to create administrator accounts by submitting a crafted form payload. The flaw stems from the plugin trusting an attacker-supplied form definition passed via $_POST['_acf_form'] as an array, which bypasses the legitimate server-side form lookup and allows the role field's allowed values to be spoofed. No public exploit identified at time of analysis, but the vulnerability is reported by Wordfence and is straightforwardly weaponizable given the documented logic flaw.

Technical ContextAI

The affected component is the ACF Frontend Form Element plugin (marketed as Frontend Admin by DynamiApps), an Advanced Custom Fields-based plugin that exposes user/profile editing forms on the public WordPress frontend. The CPE cpe:2.3:a:shabti:frontend_admin_by_dynamiapps confirms the vendor as Shabti/DynamiApps. Root cause is CWE-269 (Improper Privilege Management): the submit.php validate_form() path accepts the _acf_form parameter as either an integer form ID (safe, loaded from the database) or as a raw array (unsafe, taken verbatim from user input). The trust boundary is broken because the user action run() in user.php falls back to $form['fields'] from the attacker-supplied structure, and class-role.php pre_update_value() reads role_options from that same untrusted structure - so the role allow-list that should be enforced server-side is itself attacker-controlled.

RemediationAI

Upstream fix available via WordPress plugin trac changeset 3525193 for acf-frontend-form-element; a released patched version above 3.29.2 is not independently confirmed from the provided data, so administrators should update to the latest available release of Frontend Admin by DynamiApps from the WordPress plugin repository and verify that the installed version is greater than 3.29.2. As compensating controls until the update is verified, deactivate the Frontend Admin by DynamiApps plugin entirely (this will break any frontend user-registration or profile-edit forms it powers), or use a WAF rule to block POST requests where the _acf_form parameter is submitted as an array (e.g. _acf_form[fields]... or _acf_form[role_options]...) rather than as a single integer form ID - note this rule may break legitimate multi-step form submissions if the plugin uses array form-state in valid flows, so test in detection mode first. Restrict access to any page hosting a Frontend Admin form to authenticated users via .htaccess or a membership plugin to reduce the unauthenticated attack surface. Refer to https://www.wordfence.com/threat-intel/vulnerabilities/id/123e1758-3384-4ea7-96dd-d6adcce40392 for the vendor/Wordfence advisory.