Executive brief
The Frontend Admin by DynamiApps plugin for WordPress, which allows users to manage site content from the front-end, contains a security flaw in how it handles category and tag management. This vulnerability allows low-privileged users, such as site subscribers, to create, rename, or delete website categories and tags without permission. This could lead to unauthorized site reorganization, data loss, or disruption of how content is displayed to visitors.
Technical details
The Frontend Admin by DynamiApps plugin (also known as acf-frontend-form-element) fails to implement proper authorization checks (CWE-862) in its AJAX handlers for taxonomy management. Specifically, the 'acf/fields/related_terms/add_term', 'frontend_admin/form_submit', and 'frontend_admin/delete_object' actions do not verify if the requesting user has the 'manage_categories', 'edit_term', or 'delete_term' capabilities. An authenticated attacker with Subscriber-level privileges can exploit this by sending crafted POST requests to 'admin-ajax.php' with a valid ACF nonce to create, modify, or delete arbitrary taxonomy terms (categories, tags, etc.). This issue is resolved in version 3.29.7.
Affected products
- DynamiApps Frontend Admin by DynamiApps (acf-frontend-form-element) < 3.29.7
Timeline
- 2026-07-13: disclosed: Initial public disclosure by WPScan
- 2026-07-13: patched: Fixed in version 3.29.7
- 2026-07-30: advisory: NVD publication date