WordPress security changelog
HIGH CVE-2026-15606 Deferred

Frontend Admin token tampering lets Subscribers reset any password

Frontend Admin through 3.29.9 lets a Subscriber obtain a legitimate encrypted Current-User source token from an Edit User form they may submit. Because the AES-256-CBC ciphertext is not authenticated, the attacker can bit-flip the token so Submit_Form::check_inline_field() decrypts the posted acff source as another user_. The handler then calls acf_update_value() without reauthorizing the resolved user, and the user_password field's pre_update_value() calls wp_update_user() with the target ID and supplied password. This permits takeover of any account, including an Administrator. The cited.

CVE / CNA score 8.8 CVSS 3.1 · security@wordfence.com
NVD score Pending NVD has not published its own CVSS assessment.
Component
Frontend Admin by DynamiApps
Plugin slug
acf-frontend-form-element
Affected
<= 3.29.9
Safe version
3.29.10
Published
Aug 11, 2026
Weakness
CWE-862 — Missing Authorization

This CVE was published Aug 11, 2026 and is one of 20 known issues for this plugin.

What to do

Update, patch or deactivate.

Update to 3.29.10 or later immediately. Review password changes and low-privilege Edit User form submissions, invalidate affected sessions, and reset privileged credentials through a trusted channel.

A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.

Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.

Source record

Technical description

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.29.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level and above permissions, to reset the password of any user on the site, including administrators, leading to full account takeover and complete site compromise. Exploitation requires the attacker to hold a valid encrypted Current-User token obtained by accessing any Edit User form they are legitimately authorized to submit, which they then use as a known-plaintext base for the CBC bit-flipping forgery.

CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

Primary and upstream sources