WordPress security changelog
CRITICAL CVE-2026-18432 Deferred

Frontend Admin item_id coercion permits administrator account takeover

Frontend Admin by DynamiApps through 3.29.9 lets a crafted non-numeric item_id such as 1one bypass ActionUser::conditions_logic() because its edit_user authorization check only runs for numeric values. On a site exposing a public frontend user form, an unauthenticated attacker can obtain a signed _acf_objects payload carrying that value; WordPress later coerces it to user ID 1, allowing the administrator's password or email to be overwritten. Without a public user form, a Subscriber account is required. Other request fields and the complete payload construction are not disclosed.

CVE / CNA score 9.8 CVSS 3.1 · security@wordfence.com
NVD score Pending NVD has not published its own CVSS assessment.
Component
Frontend Admin by DynamiApps
Plugin slug
acf-frontend-form-element
Affected
<= 3.29.9
Safe version
See mitigation notes
Published
Aug 16, 2026
Weakness
CWE-269 — Improper Privilege Management

This CVE was published Aug 16, 2026 and is one of 20 known issues for this plugin.

What to do

Update, patch or deactivate.

No fixed release is identified in the authoritative record. Update when a confirmed patch is available; until then, disable public frontend user forms or the plugin when warranted, and audit administrator email, password, and session changes. The official upstream changelog lists version 3.29.10, which is newer than the published affected range. Its changelog does not clearly confirm this specific fix, so it is not counted as a known-safe release.

No confirmed safe version is listed. Consider a vendor-supported patch or temporarily restricting the affected functionality while you assess the risk.

Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.

Source record

Technical description

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.29.9. The vulnerability exists because `ActionUser::conditions_logic()` gates the `current_user_can('edit_user', $user_id)` authorization check behind an `is_numeric()` test, causing the check to be skipped entirely when `$user_id` is a non-numeric string — a condition that can be induced by passing a crafted value such as `1one` through the unvalidated `item_id` parameter of the unauthenticated `wp_ajax_nopriv_frontend_admin/forms/change_form` AJAX endpoint. This makes it possible for attackers to escalate privileges to administrator by obtaining a server-signed `_acf_objects` payload carrying the non-numeric user ID, which WordPress subsequently coerces to integer 1 (the default administrator), allowing the attacker to overwrite that account's password or email address. Exploitation by unauthenticated users requires a public-facing frontend user form to be configured; in all other cases a subscriber-level account is sufficient.

CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Primary and upstream sources