EUVD-2026-32749
GHSA-mfvv-f9h5-2mqr
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to unauthenticated privilege escalation in versions up to and including 3.29.2. This is due to insecure form submission handling that accepts arbitrary form definitions from user input instead of securely loading them from the backend. When $_POST['_acf_form'] is an array (rather than a form ID), the validate_form() function bypasses database lookup and directly processes the attacker-controlled structure. The create_record() function preserves attacker-supplied record data if present, and the user action's run() function falls back to attacker-controlled field definitions from $form['fields'] when legitimate fields cannot be found. The role field's pre_update_value() validation reads $field['role_options'] from this attacker-controlled definition, allowing an attacker to specify ['administrator'] as an allowed role and bypass the security check. This makes it possible for unauthenticated attackers to create administrator accounts by injecting a custom form configuration with a spoofed role field.
AnalysisAI
Unauthenticated privilege escalation in the Frontend Admin by DynamiApps WordPress plugin (versions up to and including 3.29.2) allows remote attackers to create administrator accounts by submitting a crafted form payload. The flaw stems from the plugin trusting an attacker-supplied form definition passed via $_POST['_acf_form'] as an array, which bypasses the legitimate server-side form lookup and allows the role field's allowed values to be spoofed. No public exploit identified at time of analysis, but the vulnerability is reported by Wordfence and is straightforwardly weaponizable given the documented logic flaw.
Technical ContextAI
The affected component is the ACF Frontend Form Element plugin (marketed as Frontend Admin by DynamiApps), an Advanced Custom Fields-based plugin that exposes user/profile editing forms on the public WordPress frontend. The CPE cpe:2.3:a:shabti:frontend_admin_by_dynamiapps confirms the vendor as Shabti/DynamiApps. Root cause is CWE-269 (Improper Privilege Management): the submit.php validate_form() path accepts the _acf_form parameter as either an integer form ID (safe, loaded from the database) or as a raw array (unsafe, taken verbatim from user input). The trust boundary is broken because the user action run() in user.php falls back to $form['fields'] from the attacker-supplied structure, and class-role.php pre_update_value() reads role_options from that same untrusted structure - so the role allow-list that should be enforced server-side is itself attacker-controlled.
RemediationAI
Upstream fix available via WordPress plugin trac changeset 3525193 for acf-frontend-form-element; a released patched version above 3.29.2 is not independently confirmed from the provided data, so administrators should update to the latest available release of Frontend Admin by DynamiApps from the WordPress plugin repository and verify that the installed version is greater than 3.29.2. As compensating controls until the update is verified, deactivate the Frontend Admin by DynamiApps plugin entirely (this will break any frontend user-registration or profile-edit forms it powers), or use a WAF rule to block POST requests where the _acf_form parameter is submitted as an array (e.g. _acf_form[fields]... or _acf_form[role_options]...) rather than as a single integer form ID - note this rule may break legitimate multi-step form submissions if the plugin uses array form-state in valid flows, so test in detection mode first. Restrict access to any page hosting a Frontend Admin form to authenticated users via .htaccess or a membership plugin to reduce the unauthenticated attack surface. Refer to https://www.wordfence.com/threat-intel/vulnerabilities/id/123e1758-3384-4ea7-96dd-d6adcce40392 for the vendor/Wordfence advisory.
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Country State City Dropdown CF7 plugin for WordPress is vulnerable to SQL Injection via the ‘cnt’ and 'sid' paramete
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today