What is the CVSS score of CVE-2026-66662?

CVE-2026-66662 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Frontend Admin are affected by CVE-2026-66662?

The Frontend Admin by DynamiApps WordPress plugin (versions ≤3.29.10) contains a critical privilege escalation vulnerability (CVE-2026-66662, CVSS 9.8) permitting unauthenticated attackers to gain…

How to fix or mitigate CVE-2026-66662?

Within 24 hours, immediately disable or remove the Frontend Admin by DynamiApps plugin from all WordPress installations to eliminate the attack vector. Within 7 days, conduct a forensic audit of all administrator and user accounts, reset all administrative credentials, and review access logs for unauthorized access or modifications occurring since plugin deployment. Within 30 days, monitor the DynamiApps vendor repository and security advisories for a patched version; when available, update to the fixed release, re-enable the plugin only after patching, and perform a comprehensive security assessment of affected sites to confirm no unauthorized access or data exfiltration occurred.

Frontend Admin CVE-2026-66662

EUVD-2026-53888 CRITICAL

Incorrect Privilege Assignment (CWE-266)

2026-08-06 Patchstack

GHSA-j7wj-8hxr-j3ww

WordPress Privilege Escalation Frontend Admin By Dynamiapps Wordpress Plugin Shabti Kaplan

9.8

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Vendor-asserted unauthenticated frontend endpoint gives AV:N/AC:L/PR:N/UI:N, and administrator takeover yields full C:H/I:H/A:H with unchanged scope.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 15:42 vuln.today

CVE Published

Aug 06, 2026 - 14:27 cve.org

CRITICAL 9.8

DescriptionCVE.org

Unauthenticated Privilege Escalation in Frontend Admin by DynamiApps <= 3.29.10 versions.

AnalysisAI

Privilege escalation in the Frontend Admin by DynamiApps WordPress plugin (versions up to and including 3.29.10) lets remote unauthenticated attackers elevate their privileges, per the CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H vector rated 9.8 Critical. The flaw (CWE-266, Incorrect Privilege Assignment) stems from the plugin's frontend user-management forms exposing role/capability assignment without proper authorization, enabling an attacker to gain administrator-level access to the WordPress site. No public exploit identified at time of analysis and the CVE is not on CISA KEV, but the CVSS profile indicates trivially weaponizable network-based abuse.

Technical ContextAI

Frontend Admin by DynamiApps (plugin slug acf-frontend-form-element, internally tied to ACF frontend form elements) provides frontend-facing forms that let site visitors and members register, edit profiles, and manage content without touching wp-admin. The CPE cpe:2.3:a:shabti_kaplan:frontend_admin_by_dynamiapps identifies the affected component. The root cause is classed as CWE-266 (Incorrect Privilege Assignment): the plugin assigns or permits modification of user roles/capabilities through a frontend flow that fails to verify the requester is authorized to grant those privileges, so a low-privileged or anonymous request can result in a higher role (typically administrator) being assigned. This is a common WordPress plugin failure mode where user-meta or role fields are exposed in a form and not server-side gated by capability checks or nonce/authorization validation.

RemediationAI

No vendor-released patch version is identified in the provided data (the EUVD entry lists the upper affected bound as ≤3.29.10 with no stated fix release), so update the plugin to the latest available version above 3.29.10 from the WordPress plugin repository once published and confirm the changelog references this privilege-escalation fix; consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/acf-frontend-form-element/vulnerability/wordpress-frontend-admin-by-dynamiapps-plugin-3-29-10-privilege-escalation-vulnerability for the exact patched version. Until a confirmed patched build is installed, restrict exposure by deactivating the Frontend Admin plugin (this disables all frontend registration/profile/management forms it provides), or by placing its frontend form endpoints behind authentication or a WAF rule and disabling any form that exposes user role/capability fields - noting these controls will break legitimate frontend user self-service. As a compensating measure, audit existing WordPress users for unexpected administrator or elevated roles created recently, since a successful attack manifests as rogue high-privilege accounts.