Frontend Admin by DynamiApps: Privilege escalation in WordPress plugin
Summary
Frontend Admin by DynamiApps, a WordPress plugin for frontend forms, allows privilege escalation through incorrect privilege assignment (CVE-2026-109892, CVSS 9.8). According to the CVE record and Patchstack, an attacker with low privileges, and according to Patchstack possibly without login, can gain administrator rights and full control of the website. Exploitation depends on the configuration and prerequisites of this specific ID, which are not confirmed.
Affected
- Frontend Admin by DynamiApps (WordPress plugin, slug acf-frontend-form-element)
- Versions from n/a through 3.29.13 according to the CVE record
Fixed in
- Fixed version for this CVE: Unknown. Patchstack lists 3.30.0 as the patched version.
- Related CVE-2026-75816 is reported as fixed in 3.29.13; the vendor has not yet clarified the relationship.
Workaround
- No vendor-confirmed workaround.
- Disable user registration if not strictly necessary.
- Restrict access to wp-admin via IP allowlisting.
- If no update is available, deactivate the plugin.
Exploitation
- CISA SSVC: Exploitation none, automatable yes, technical impact total.
- Not listed in KEV according to a third-party aggregator.
- No public proof-of-concept found for this CVE ID.
- Patchstack expects exploitation and mass-exploit campaigns are possible.
Our recommendation
- Inventory all WordPress sites with this plugin and record the exact version.
- Update to version 3.30.0 or the latest release now.
- Deactivate and remove the plugin if it is not needed.
- Audit administrator accounts, recent email changes and password resets, and check for unknown admin accounts.
- Monitor the Patchstack page and the vendor changelog for confirmation of the fixed version.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack advisory patchstack.com
- OpenCVE CVE-2026-109892 app.opencve.io
- VulDB entry 420631 vuldb.com
- Strix CVE-2026-109892 www.strix.ai
- WPScan plugin page wpscan.com
- OffSeq Radar CVE-2026-109892 radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 17:50.
Original description (NVD)
Incorrect Privilege Assignment vulnerability in Shabti Kaplan Frontend Admin by DynamiApps acf-frontend-form-element allows Privilege Escalation.This issue affects Frontend Admin by DynamiApps: from n/a through 3.29.13.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.