A CVSS 9.8 privilege escalation flaw in the Frontend Admin by DynamiApps WordPress plugin lets attackers overwrite the default administrator's password or email, with unauthenticated exploitation possible on sites running a public frontend user form.
What Is It
The bug is a broken authorization check (CWE-269) in ActionUser::conditions_logic(). The plugin gates its current_user_can('edit_user', $user_id) capability check behind an is_numeric() test; so when $user_id is a non-numeric string, the check is skipped entirely rather than failing closed.
That condition is attacker-controlled. The unauthenticated AJAX endpoint wp_ajax_nopriv_frontend_admin/forms/change_form does not validate its item_id parameter, so a crafted value such as 1one passes straight through. The attacker uses this to obtain a server-signed _acf_objects payload carrying the non-numeric user ID. WordPress then coerces that value to integer 1, the default administrator account; allowing the attacker to overwrite that account's password or email address and take it over.
Why It Matters
Wordfence rates this CVSS 3.1 9.8 (CRITICAL), vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, network-reachable, low complexity, no privileges, no user interaction, with high impact to confidentiality, integrity, and availability. Successful exploitation yields administrator control of the WordPress site.
Unauthenticated exploitation requires a public-facing frontend user form to be configured. Where no such form exists, a subscriber-level account is sufficient; a low bar on any site with open registration.
The supplied CISA KEV data contains no entry for this CVE, so there is no KEV-confirmed active exploitation and no KEV remediation deadline at this time.
What's Vulnerable
- Vendor: shabti
- Product: Frontend Admin by DynamiApps (WordPress plugin, slug
acf-frontend-form-element) - Affected versions: all versions up to and including 3.29.9
Patch Status
The NVD record was published 2026-08-16 with status Received. It references a plugin changeset (3633030@acf-frontend-form-element) alongside the vulnerable code in tags 3.29.3 and 3.29.9. No fixed version number is stated in the supplied data. Administrators should review the referenced changeset and Wordfence advisory and update to a release later than 3.29.9 as soon as one is confirmed available; in the interim, removing public-facing frontend user forms eliminates the unauthenticated path.