Live › vulnerability › CVE-2026-81343
Go to dashboardThe ACF Frontend Admin plugin for WordPress, through version 3.29.13, skips a capability check on one of its form-submission actions. An unauthenticated visitor can use a public form to overwrite site-wide ACF option values.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the ACF Frontend Admin plugin through 3.29.13 that expose a frontend form which writes to ACF options. Sites without this plugin or without a public form that submits to ACF options are not affected by this description.
No product ranges from the sources yet.
3.29.13 are affected.3.29.13.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The ACF Frontend Admin by DynamiApps WordPress plugin through 3.29.13 does not perform a capability check on one of its form-submission actions before writing submitted values into the site's global ACF options store, allowing unauthenticated visitors to overwrite site-wide option values via a public form.
This page as .md · .json · in your agent: get_signal("CVE-2026-81343")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.