CVE-2026-6226

Vulnerability

The Frontend Admin by DynamiApps plugin for WordPress (versions up to and including 3.29.2) contains an unauthenticated privilege escalation vulnerability in form submission handling. The validate_form() function in submit.php [3][4] accepts arbitrary form definitions from $_POST['_acf_form'] when it is an array, instead of securely loading a stored form definition from the database. This allows an attacker to inject a custom form configuration with a malicious role field that defines ['administrator'] in its role_options. The create_record() function preserves attacker-supplied record data, and the user action's run() function falls back to attacker-controlled field definitions from $form['fields'] when legitimate fields cannot be found. The role field's pre_update_value() validation reads $field['role_options'] from this attacker-controlled definition, bypassing the security check [1][2].

Exploitation

An unauthenticated attacker can exploit this by sending a POST request to a page that processes forms via the plugin. The attacker sets $_POST['_acf_form'] to an array containing a crafted form definition that includes a user action to create a new user, and a role field with role_options set to ['administrator']. The attacker also supplies the desired username, email, and password in the acff array. No prior authentication, user interaction, or special network position is required beyond the ability to send HTTP POST requests to the target site.

Impact

Successful exploitation allows an unauthenticated attacker to create a new user account with Administrator privileges on the WordPress site, granting full control over the site. This can lead to complete compromise of the site, including data theft, malware injection, or site defacement.

Mitigation

The vendor has released version 3.29.3 which fixes the issue by properly validating form definitions and preventing arbitrary form injection. Users should update to version 3.29.3 or later immediately. No workaround is available for unpatched versions. This CVE is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog as of the publication date.