Frontend Admin EUVD-2026-119766

The target must be running the Frontend Admin by DynamiApps plugin (acf-frontend-form-element) at a version from an unspecified lower bound through 3.30.1, with its frontend form/admin functionality reachable. Per the CVSS vector (PR:N/UI:N/AC:L), no authentication, no user interaction, and no special complexity are required for network exploitation, so a default deployment of the affected plugin is exposed. The exact feature, configuration, or request that triggers the incorrect privilege assignment is not described in the available sources. The primary limiting factor is simply having the vulnerable plugin installed and active at an affected version.

Multiple signals converge on genuine high priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity flaw requiring no privileges and no user interaction, and the 9.1 score reflects high confidentiality and integrity impact (C:H/I:H) with no availability impact (A:N) - consistent with CWE-266 Incorrect Privilege Assignment leading to privilege escalation. The vuln.today decision label is 'act_now', reinforcing urgency. However, several corroborating signals are absent: no EPSS exploitation-probability score was provided, the CVE is not listed in CISA KEV, and no working proof-of-concept is confirmed - the sole reference is a Patchstack database advisory page, not verified exploit code. So this is a high-severity, low-complexity unauthenticated privilege-escalation flaw that warrants prompt remediation per the act_now label, but there is no evidence yet of active exploitation or public weaponization; the risk is driven by severity and ease of exploitation rather than observed in-the-wild activity. Note also the description states affected versions 'from n/a through 3.30.1' but does not name a fixed version, so the remediation target is not confirmed from the available data and should be verified with Patchstack/the vendor.

A remote, unauthenticated attacker interacts with the Frontend Admin plugin's frontend form functionality on a WordPress site running a version up to and including 3.30.1 and abuses the incorrect privilege assignment to grant themselves or a newly created account elevated privileges (e.g., administrator). The precise trigger mechanism is not described in the available sources. No working public exploit is confirmed - the only reference is a Patchstack advisory page, not verified exploit code.