CVE-2026-81343

MediumCVSS 5.3

Published: 17/10/2026(UTC)Updated: 19/10/2026(UTC)Translated: 17/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.18%

7th percentile - higher than 7% of all known CVEs

Summary

The ACF Frontend Admin by DynamiApps WordPress plugin through 3.29.13 does not perform a capability check on one of its form-submission actions before writing submitted values into the site's global ACF options store, allowing unauthenticated visitors to overwrite site-wide option values via a public form.

Risk Assessment

An attacker can overwrite site-wide options, potentially leading to configuration changes, display of unwanted content, or disruption of site operation.

Recommendation

Update the ACF Frontend Admin by DynamiApps plugin to a version later than 3.29.13.

Other vulnerabilities in ACF Frontend Admin by DynamiApps WordPress plugin

CVE-2026-81344Medium
The ACF Frontend Admin by DynamiApps WordPress plugin through 3.29.13 does not restrict which PHP classes may be instantiated when it deserialises stored post content that is rendered on public-facing pages, allowing high-privilege users such as administrators to inject a PHP object which, given a suitable POP chain in another installed ACF Frontend Admin by DynamiApps WordPress plugin through 3.29.13 or in WordPress core, can be leveraged to achieve remote code execution.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS