Security Alert Summary
The Frontend Admin by DynamiApps plugin for WordPress (“Frontend Admin”) contains a privilege escalation vulnerability (CVE-2026-6228) in versions up to and including 3.28.36. Insufficient authorization checks in the role update flow, combined with permissive capabilities on the admin_form custom post type, can allow an attacker who can create editor-level forms to assign the administrator role to themselves via crafted POST requests.
CVE Details
- CVE ID: CVE-2026-6228
- Affected component: Frontend Admin by DynamiApps plugin for WordPress
- Affected versions: Versions up to and including 3.28.36
- Published: May 15, 2026 at 9:16:16 AM UTC
- Last modified: May 15, 2026 at 2:09:15 PM UTC
- CVSS v3.1: Base Score 8.8, Severity: HIGH
- CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Authentication / privileges: Privileges Required: Low (an attacker needs an account with editor-level privileges to exploit the role-assignment flow described); User Interaction: None; Attack Vector: Network
- Primary impact: Confidentiality: High; Integrity: High; Availability: High
- Weakness (CWE): CWE-269 (Improper Privilege Management)
Technical Details
This vulnerability exists because the admin_form custom post type is registered with capability_type => 'page', which grants editor-level users the ability to create and edit forms. The plugin exposes a mechanism where an editor-created “edit_user” form can contain a role_options array. An attacker can bypass UI restrictions enforced by feadmin_get_user_roles() by submitting crafted POST data directly to wp-admin/post.php, inserting “administrator” into the form’s role_options.
When that form is later used to update a user, the function pre_update_value() in class-role.php performs only a check that the submitted role is present in the form’s role_options (lines 107-110) but does not verify that the current user is permitted to assign that specific role. As a result, an attacker who can register as an editor (for example, via a public new_user form) can create or alter an edit_user form to include the administrator role and then escalate their own privileges to administrator by submitting the form.
The impact is privilege escalation via insufficient authorization checks on role assignment; the flaw is in missing capability verification rather than in a cryptographic or storage weakness.
How This Could Impact Your Website
Consider a site with a site owner, several internal staff members with editor privileges, and external contributors or contractors who can access public forms. An attacker who is able to register as or obtain an editor-level account could create or modify an edit_user form to allow assignment of the administrator role. If the attacker then uses that form to change their own role, they gain administrative access.
- An attacker with escalated privileges could view or export internal user data, including email addresses, which increases the risk of targeted phishing or social engineering.
- Administrative access can allow the attacker to install plugins or change site settings, which may affect site integrity and availability.
- Compromised administrator accounts can be used to impersonate staff or contractors, complicating incident response and remediation.
If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles and capability grants, especially for editors and any custom post type capability mappings.
- Enforce strong passwords and two-factor authentication for editor and administrator accounts.
- Remove unused or unmaintained plugins and restrict public forms that allow user registration or role changes.
- Monitor site activity and logs for unusual behavior, new administrator accounts, or unexpected role changes.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/acf-frontend-form-element/trunk/main/admin/admin-pages/forms/post-types.php#L53
- https://plugins.trac.wordpress.org/browser/acf-frontend-form-element/trunk/main/frontend/fields/user/class-role.php#L113
- https://plugins.trac.wordpress.org/browser/acf-frontend-form-element/trunk/main/frontend/forms/actions/user.php#L517
- https://plugins.trac.wordpress.org/changeset/3519460
- https://www.wordfence.com/threat-intel/vulnerabilities/id/083accd0-8338-47c6-b396-96679b95dd40?source=cve
