Overview
CVE-2026-119506 (CVSS 9.1) is an incorrect privilege assignment vulnerability in Frontend Admin by DynamiApps (acf-frontend-form-element), a WordPress plugin that lets site owners build front-end forms for content and user management. It allows privilege escalation and affects versions from n/a through 3.30.1.
Technical Details
| Item | Detail |
|---|---|
| Plugin | Frontend Admin by DynamiApps |
| Slug | acf-frontend-form-element |
| Weakness | Incorrect privilege assignment |
| Affected | Through 3.30.1 |
| CVSS | 9.1 (Critical) |
Plugins that expose user-registration or profile forms on the front end are a common source of this bug class: if a role or capability value is accepted or assigned without proper validation, a low-privileged visitor can end up with higher rights, up to administrator.
NVD's public description does not detail the exact exploitation path, so treat any further specifics as unconfirmed until the vendor or a researcher publishes them.
Impact
- A low-privileged user may gain elevated roles on the WordPress site
- Administrator access allows plugin and theme uploads, which leads to code execution on the server
- Content tampering, malware injection, and data theft
Recommended Actions
- Update Frontend Admin by DynamiApps to a release newer than 3.30.1 once a fixed version is available.
- Until then, consider deactivating the plugin or disabling forms that handle user registration or role fields.
- Audit WordPress users for unexpected administrator or editor accounts.
- Review recent plugin, theme, and file changes for signs of compromise.
- Enforce multi-factor authentication for administrator accounts.