Vulnerability · Published Oct 17, 2026 · Assigned by WPScan
CVE-2026-81343Frontend Admin by DynamiApps <= 3.29.13 - Unauthenticated ACF Options Page Field Update via Form Submission
Medium 5.3
In plain English
A medium-severity missing authorization in ACF Frontend Admin by DynamiApps from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 7% of all known vulnerabilities).
Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.2%top 93.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The ACF Frontend Admin by DynamiApps WordPress plugin through 3.29.13 does not perform a capability check on one of its form-submission actions before writing submitted values into the site's global ACF options store, allowing unauthenticated visitors to overwrite site-wide option values via a public form.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | ACF Frontend Admin by DynamiApps | 0 – through 3.29.13 |
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
References
- https://wpscan.com/vulnerability/1919eb80-195e-48ed-b58e-3cab4bb1d73d/ exploit, vdb-entry, technical-description