{"id":"CVE-2026-119506","kind":"vulnerability","aliases":["CVE-2026-119506"],"related":[],"title":"Frontend Admin WordPress plugin: privilege escalation through incorrect privilege assignment","description":"Incorrect Privilege Assignment vulnerability in DynamiApps Frontend Admin by DynamiApps acf-frontend-form-element allows Privilege Escalation.This issue affects Frontend Admin by DynamiApps: from n/a through 3.30.1.","summary":"Frontend Admin by DynamiApps, a WordPress plugin, has an incorrect privilege assignment flaw that lets a user gain higher privileges than they should have. The NVD record rates it critical (CVSS 9.1) and affects all versions through 3.30.1.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["acf-frontend-form-element","frontend-admin","package","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed version of the Frontend Admin by DynamiApps plugin (acf-frontend-form-element) in the WordPress Plugins screen, and see whether it is `3.30.1` or older.\n- Review which users hold roles that can submit frontend forms.","fix":"- Frontend Admin by DynamiApps: unknown, the sources give no fixed version.","status":"open","published_at":"2026-11-09T01:17:01+00:00","first_seen_at":"2026-11-09T01:23:57+00:00","triaged_at":"2026-11-09T01:25:32+00:00","updated_at":"2026-11-09T01:25:32+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-09T01:25:32Z","model":"claude-haiku-5-5","output":{"fix":"- Frontend Admin by DynamiApps: unknown, the sources give no fixed version.","reach":"internet","title":"Frontend Admin WordPress plugin: privilege escalation through incorrect privilege assignment","impact":"high","summary":"Frontend Admin by DynamiApps, a WordPress plugin, has an incorrect privilege assignment flaw that lets a user gain higher privileges than they should have. The NVD record rates it critical (CVSS 9.1) and affects all versions through 3.30.1.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","frontend-admin","acf-frontend-form-element"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker gains elevated privileges on the WordPress site","analyst_note":"Find the fixed version and the trigger conditions in the NVD record or the plugin vendor's changelog (https://nvd.nist.gov/vuln/detail/CVE-2026-119506).","how_to_check":"- Check the installed version of the Frontend Admin by DynamiApps plugin (acf-frontend-form-element) in the WordPress Plugins screen, and see whether it is `3.30.1` or older.\n- Review which users hold roles that can submit frontend forms.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Frontend Admin by DynamiApps WordPress plugin (acf-frontend-form-element) at version 3.30.1 or older are exposed. The sources do not say which user roles or settings are needed to trigger the flaw, so treat any site with frontend forms and user accounts as in scope.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000776,"input_tokens":4558,"output_tokens":641,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-119506':13A,16A '-2026':12A,15A '3.30.1':64B,92C '9.1':58B 'acf':18B,76C 'acf-frontend-form-el':17B,75C 'admin':2A,24B,28B,72C,86C 'affect':60B,84C 'allow':80C 'assign':10A,38B,67C 'critic':56B 'cve':11A,14A 'cvss':57B 'dynamiapp':30B,70C,74C,88C 'element':21B,79C 'escal':6A 'escalation.this':82C 'flaw':39B 'form':20B,78C 'frontend':1A,19B,23B,27B,71C,77C,85C 'frontend-admin':22B 'gain':44B 'higher':45B 'incorrect':8A,36B,65C 'issu':83C 'let':41B 'n/a':90C 'nvd':52B 'packag':25B 'plugin':4A,33B 'privileg':5A,9A,37B,46B,66C,81C 'rate':54B 'record':53B 'user':43B 'version':62B 'vulner':68C 'wordpress':3A,26B,32B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Frontend Admin by DynamiApps WordPress plugin (acf-frontend-form-element) at version 3.30.1 or older are exposed. The sources do not say which user roles or settings are needed to trigger the flaw, so treat any site with frontend forms and user accounts as in scope.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["acffrontendformelement","critical","frontendadmin","package","wordpress"],"campaign_type":null,"search_a":"'-119506':13A,16A '-2026':12A,15A 'admin':2A 'assign':10A 'cve':11A,14A 'escal':6A 'frontend':1A 'incorrect':8A 'plugin':4A 'privileg':5A,9A 'wordpress':3A","search_b":"'3.30.1':64B '9.1':58B 'acf':18B 'acf-frontend-form-el':17B 'admin':24B,28B 'affect':60B 'assign':38B 'critic':56B 'cvss':57B 'dynamiapp':30B 'element':21B 'flaw':39B 'form':20B 'frontend':19B,23B,27B 'frontend-admin':22B 'gain':44B 'higher':45B 'incorrect':36B 'let':41B 'nvd':52B 'packag':25B 'plugin':33B 'privileg':37B,46B 'rate':54B 'record':53B 'user':43B 'version':62B 'wordpress':26B,32B","search_c":"'3.30.1':92C 'acf':76C 'acf-frontend-form-el':75C 'admin':72C,86C 'affect':84C 'allow':80C 'assign':67C 'dynamiapp':70C,74C,88C 'element':79C 'escalation.this':82C 'form':78C 'frontend':71C,77C,85C 'incorrect':65C 'issu':83C 'n/a':90C 'privileg':66C,81C 'vulner':68C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T01:17:01+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119506","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119506","severity":null,"published_at":"2026-11-09T01:17:01+00:00","modified_at":"2026-11-09T01:17:02+00:00","first_seen_at":"2026-11-09T01:23:57+00:00","fetched_at":"2026-11-09T01:23:57+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}