Frontend Admin EUVD-2026-32749

Exploitation requires that the target WordPress site has the Frontend Admin by DynamiApps plugin (acf-frontend-form-element) installed and active at a version <= 3.29.2, and that at least one Frontend Admin form is rendered on a page reachable by anonymous visitors - the vulnerability is in the submission handler so the attacker does not need to use the legitimate form, only to POST to the endpoint that processes _acf_form. The exploitable code path is specifically triggered when $_POST['_acf_form'] is submitted as an array rather than a numeric form ID, which causes the database-backed form definition to be skipped in favor of the attacker-supplied structure containing a spoofed role field with role_options of ['administrator']. The description states no authentication is required (contradicting the CVSS PR:L value, which should be treated as a scoring inconsistency), no user interaction is required (UI:N), and no non-default configuration is needed beyond having the plugin installed with an exposed form endpoint.

There is a notable conflict in the data: the NVD description explicitly labels this as an unauthenticated privilege escalation, but the supplied CVSS:3.1 vector contains PR:L (low privileges required), which would normally imply authenticated exploitation - the PR:L score appears inconsistent with the described logic flaw and Wordfence's classification, and the description should be considered authoritative pending vendor confirmation. Other vector components (AV:N, AC:L, UI:N, C:H/I:H/A:H) are consistent with a trivially remote, fully impacting attack. No EPSS, KEV, or SSVC data was provided in the input, and no public exploit identified at time of analysis. Despite the absence of KEV/EPSS signals, the combination of WordPress ubiquity, an unauthenticated path to administrator account creation, and clear code-level disclosure pointing at exact source lines (display.php:245, submit.php:124, user.php:458, class-role.php:107) makes this a high-priority patch for any site running the plugin - historically, similar WordPress privilege-escalation flaws see rapid mass scanning once advisory details are public.

An unauthenticated attacker locates any public-facing page on a WordPress site that embeds a Frontend Admin form (commonly a registration, profile, or contributor form) and submits a crafted POST request where _acf_form is an array containing fields[] with a role field whose role_options is set to ['administrator'] and a chosen username/password/email. Because validate_form() trusts the attacker-supplied form structure and pre_update_value() reads the allow-list from that same structure, the role check passes and a new administrator account is provisioned, after which the attacker logs into /wp-admin and installs a malicious plugin or theme for persistence. No POC was identified in the provided sources, but the disclosed source-line references make reproduction straightforward.