ACF Frontend Admin EUVD-2026-103258

Exploitation requires that the target site runs ACF Frontend Admin by DynamiApps at version ≤3.29.13 AND that at least one of the plugin's form-submission actions is reachable through a publicly published front-end form (a form must be configured and exposed on the site). The limiting factor is therefore deployment-dependent: if no public ACF Frontend Admin form is published, the vulnerable action is not externally reachable. Where such a form exists, no authentication, privileges, or user interaction are required (consistent with PR:N/UI:N), and default-reachable forms are directly abusable by anonymous visitors.

The input provides a CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N (base 5.3, Medium), indicating a network-reachable, low-complexity, unauthenticated flaw with no user interaction and an impact limited to integrity (I:L); confidentiality and availability are explicitly unaffected. This is consistent with CWE-862 (Missing Authorization): the plugin omits a capability check before writing attacker-supplied values into WordPress's global ACF options store. No EPSS score, SSVC decision data, KEV listing, or POC indicator was supplied in the input, so exploitation probability and automatability cannot be quantified from the available signals - their absence is not evidence of low risk, merely missing data. The realistic risk is moderate: exploitation is trivial (public form, no auth) but the ceiling is bounded to integrity-only tampering of site options rather than full compromise, which is why the score sits at Medium rather than Critical. Note a labeling tension: the input Tags include 'Authentication Bypass,' but the CWE (862) and description describe a missing authorization / broken access control issue, not authentication bypass - verify categorization with the WPScan advisory. No public exploit is identified at time of analysis.

An unauthenticated attacker locates a WordPress site running ACF Frontend Admin (≤3.29.13) that exposes one of the plugin's public form-submission actions, then submits a crafted request mapping input values to site-wide ACF option keys. Because no capability check is performed, the submitted values are written directly into the global ACF options store, letting the attacker overwrite site configuration values remotely. No public exploit code is identified in the provided data, but the attack requires no authentication or user interaction.