Security Alert Summary
The Frontend Admin by DynamiApps WordPress plugin contains a vulnerability that allows attackers to supply custom form definitions which are processed without proper backend validation. An attacker who can submit a specially crafted form structure may be able to create administrator accounts by controlling the role field validation and bypassing intended checks.
CVE Details
- CVE ID: CVE-2026-6226
- Affected plugin or component: Frontend Admin by DynamiApps plugin for WordPress
- Affected versions: Versions up to and including 3.29.2
- Published: May 28, 2026 at 9:16:47 AM
- Last modified: May 28, 2026 at 1:45:25 PM
- CVSS v3.1: Base score 8.8, Severity HIGH, Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Authentication / Privileges / User interaction (from CVSS): Privileges Required: Low (PR:L); User Interaction: None (UI:N); Attack Vector: Network (AV:N)
- Primary impact: Confidentiality: High; Integrity: High; Availability: High
- Weakness (CWE): CWE-269
Technical Details
The plugin accepts form definitions from user-submitted input in $_POST['_acf_form']. When that value is an array rather than a form identifier, the plugin’s validate_form() function bypasses the normal database lookup and processes the attacker-supplied structure directly. The create_record() function can preserve attacker-supplied record data, and the user action run() implementation falls back to field definitions found in $form['fields'] when legitimate fields cannot be retrieved.
The role field’s pre_update_value() validation reads $field['role_options'] from the (attacker-controlled) field definition. An attacker can therefore craft a form definition that lists ['administrator'] as an allowed role, causing the plugin to accept and create an account with that role. The weakness stems from accepting and using arbitrary form configuration from request data instead of securely loading and validating form definitions from the backend.
Because the plugin processes attacker-controlled structures instead of enforcing server-side lookups and restrictions, an attacker able to submit such a form can create administrator accounts. The description indicates this can be performed without proper authentication checks in the form handling flow.
How This Could Impact Your Website
Consider a small team managing a WordPress site: a site owner, an internal editor, and an external contractor who contributes content via frontend forms. If an attacker submits a crafted frontend form that the plugin accepts, they could create an administrator account without following normal administrative workflows. That administrator account could be used to modify content, change site settings, install or remove plugins, or add further user accounts.
Practical consequences include exposure of internal user information (for example, user email addresses), increased risk of targeted phishing or social engineering against staff and contractors, and unauthorized changes to site content or configuration. The vulnerability specifically enables attacker-created admin accounts by injecting a spoofed role field; it should be treated as a high-risk account-creation vector.
If you9re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor-level accounts and any roles that can be escalated to higher privileges.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins and disable frontend features you do not need.
- Monitor site activity and logs for unusual user creation events, unexpected role changes, or unfamiliar administrator accounts.
If you9d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/acf-frontend-form-element/tags/3.28.33/main/frontend/fields/user/class-role.php#L107
- https://plugins.trac.wordpress.org/browser/acf-frontend-form-element/tags/3.28.33/main/frontend/forms/actions/user.php#L458
- https://plugins.trac.wordpress.org/browser/acf-frontend-form-element/tags/3.28.33/main/frontend/forms/classes/display.php#L245
- https://plugins.trac.wordpress.org/browser/acf-frontend-form-element/tags/3.28.33/main/frontend/forms/classes/submit.php#L124
- https://plugins.trac.wordpress.org/browser/acf-frontend-form-element/trunk/main/frontend/fields/user/class-role.php#L107
- https://plugins.trac.wordpress.org/browser/acf-frontend-form-element/trunk/main/frontend/forms/actions/user.php#L458
- https://plugins.trac.wordpress.org/browser/acf-frontend-form-element/trunk/main/frontend/forms/classes/display.php#L245
- https://plugins.trac.wordpress.org/browser/acf-frontend-form-element/trunk/main/frontend/forms/classes/submit.php#L124
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3525193%40acf-frontend-form-element&new=3525193%40acf-frontend-form-element&sfp_email=&sfph_mail=
- https://www.wordfence.com/threat-intel/vulnerabilities/id/123e1758-3384-4ea7-96dd-d6adcce40392?source=cve
