ACF Frontend Admin by DynamiApps

ACF Frontend Admin by DynamiApps has 36 disclosed vulnerabilities in the WordSec catalog, reported between 2022 and 2026; 35 are fixed and 1 remains unpatched as of October 2026. Their average CVSS score is 7.3, and the most serious one scores 9.8 out of 10. Severity breakdown: 8 critical and 12 high. 2026 was the busiest year with 25 disclosures.

The most common weakness is Cross-Site Scripting, behind 8 of the records (22%). Other recurring categories include Missing Authorization, Improper Privilege Management.

35 of the records (97%) have a vendor fix, while 1 remain unpatched. The oldest unresolved one dates back to 2026.

27 independent researchers contributed these findings, most of them (3) reported by Max Boll (_b0lli). ACF Frontend Admin by DynamiApps is installed on roughly 8,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.

01234567891019.09.2019Today04.03.20226.3Freemius SDK <= 2.4.2 - Missing Authorization Checks CVSS 6.3 · 04.03.202218.07.20236.1Freemius SDK <= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get CVSS 6.1 · 18.07.202327.12.20239.8Frontend Admin by DynamiApps Plugin <= 3.18.3 - Unauthenticated Arbitrary File Upload CVSS 9.8 · 27.12.202318.04.20249.8Frontend Admin by DynamiApps <= 3.19.4 - Improper Missing Encryption Exception Handling to Form Manipulation CVSS 9.8 · 18.04.202413.12.20248.1Frontend Admin by DynamiApps <= 3.24.5 - Unauthenticated Privilege Escalation CVSS 8.1 · 13.12.20247.2Frontend Admin by DynamiApps <= 3.24.5 - Unauthenticated Stored Cross-Site Scripting CVSS 7.2 · 13.12.202420.12.20245.9Frontend Admin by DynamiApps <= 3.25.1 - Unauthenticated SQL Injection CVSS 5.9 · 20.12.202423.02.20256.1Frontend Admin by DynamiApps <= 3.25.17 - Reflected Cross-Site Scripting CVSS 6.1 · 23.02.202526.06.20256.5Frontend Admin by DynamiApps <= 3.28.7 - Authenticated (Editor+) Arbitrary File Deletion CVSS 6.5 · 26.06.202512.08.20256.5Frontend Admin by DynamiApps <= 3.28.3 - Authenticated (Subscriber+) SQL Injection CVSS 6.5 · 12.08.202503.12.20259.8Frontend Admin by DynamiApps <= 3.28.20 - Unauthenticated Arbitrary Options Update CVSS 9.8 · 03.12.202508.01.20269.8Frontend Admin by DynamiApps <= 3.28.29 - Unauthenticated Privilege Escalation to Administrator via Role Form Field CVSS 9.8 · 08.01.20269.1Frontend Admin by DynamiApps <= 3.28.25 - Missing Authorization to Unauthenticated Arbitrary Data Deletion via 'delete post' Form Element CVSS 9.1 · 08.01.20267.2Frontend Admin by DynamiApps <= 3.28.23 - Unauthenticated Stored Cross-Site Scripting via 'update_field' CVSS 7.2 · 08.01.202625.03.20267.2Frontend Admin by DynamiApps <= 3.28.31 - Authenticated (Editor+) PHP Object Injection via 'post_content' of Admin Form Posts CVSS 7.2 · 25.03.202614.05.20268.8Frontend Admin by DynamiApps <= 3.28.36 - Unauthenticated Privilege Escalation via Edit User Form CVSS 8.8 · 14.05.202627.05.20268.8Frontend Admin by DynamiApps <= 3.29.2 - Unauthenticated Privilege Escalation via Form Configuration Injection CVSS 8.8 · 27.05.20268.8Frontend Admin by DynamiApps <= 3.29.2 - Missing Authorization to Authenticated (Subscriber+) Account Takeover via 'user_id' URL Query Parameter CVSS 8.8 · 27.05.202628.05.20264.9Frontend Admin by DynamiApps <= 3.28.28 - Authenticated (Administrator+) SQL Injection via 'order' Parameter CVSS 4.9 · 28.05.202616.07.20267.2Frontend Admin by DynamiApps <= 3.29.8 - Unauthenticated Stored Cross-Site Scripting CVSS 7.2 · 16.07.202605.08.20264.3Frontend Admin by DynamiApps < 3.29.7 - Missing Authorization CVSS 4.3 · 05.08.20264.3Frontend Admin by DynamiApps <= 3.29.10 - Missing Authorization CVSS 4.3 · 05.08.20269.8Frontend Admin by DynamiApps <= 3.29.12 - Unauthenticated Privilege Escalation CVSS 9.8 · 05.08.202611.08.20268.8Frontend Admin by DynamiApps <= 3.29.9 - Authenticated (Subscriber+) Arbitrary Password Reset via Encrypted Object Token CVSS 8.8 · 11.08.202615.08.20269.8Frontend Admin by DynamiApps <= 3.29.9 - Unauthenticated Privilege Escalation via 'item_id' Parameter CVSS 9.8 · 15.08.202618.08.20266.4Frontend Admin by DynamiApps <= 3.29.10 - Authenticated (Contributor+) Stored Cross-Site Scripting CVSS 6.4 · 18.08.202627.08.20264.3Frontend Admin by DynamiApps < 3.29.11 - Authenticated (Subscriber+) Membership Plan Deletion CVSS 4.3 · 27.08.202631.08.20267.5Frontend Admin by DynamiApps <= 3.29.12 - Unauthenticated Arbitrary File Deletion via Path Traversal via custom_directory_name Merge Tag CVSS 7.5 · 31.08.20266.4Frontend Admin by DynamiApps <= 3.29.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tag' Shortcode Attribute CVSS 6.4 · 31.08.202602.09.20268.2Frontend Admin by DynamiApps <= 3.29.12 - Unauthenticated Path Traversal CVSS 8.2 · 02.09.202605.09.20269.8Frontend Admin by DynamiApps <= 3.29.12 - Unauthenticated Account Takeover via '_acf_objects' Object Identifier CVSS 9.8 · 05.09.202607.10.20264.9Frontend Admin by DynamiApps <= 3.29.13 - Authenticated (Administrator+) SQL Injection CVSS 4.9 · 07.10.202609.10.20266.4Frontend Admin by DynamiApps <= 3.28.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Content CVSS 6.4 · 09.10.202613.10.20267.3ACF Frontend Admin by DynamiApps <= 3.29.13 - Unauthenticated Privilege Escalation CVSS 7.3 · 13.10.202615.10.20265.3Frontend Admin by DynamiApps <= 3.29.0 - Missing Authorization CVSS 5.3 · 15.10.20266.6Frontend Admin by DynamiApps <= 3.29.0 - Authenticated (Administrator+) PHP Object Injection CVSS 6.6 · 15.10.2026

Strategic Overview

Avg CVSSHigh
7.3/ 10
Patch Coverage97%
Open

1

Fixed

35

Get automatic notifications for all ACF Frontend Admin by DynamiApps vulnerabilities before they are exploited.

Most severe open issueCVSS 4.9CVE-2026-42722

Frontend Admin by DynamiApps <= 3.29.13 - Authenticated (Administrator+) SQL Injection

Read the full analysis

Vulnerability Records

36 records
2026-10-15 00:00CVE-2026-81343
5.3
Medium
Karthik RamakrishnanYes
2026-10-15 00:00CVE-2026-81344
6.6
Medium
Karthik RamakrishnanYes
2026-10-13 12:52CVE-2026-109892
7.3
High
ZeinYes
2026-10-09 17:51CVE-2026-6243
6.4
Medium
Muhammad Yudha - DJYes
2026-10-07 00:00CVE-2026-42722
4.9
Medium
Ananda DhakalNo
2026-09-05 13:59CVE-2026-75816
9.8
Critical
thevietroninYes
2026-09-02 00:00CVE-2026-81347
8.2
High
RIA LabsYes
2026-08-31 15:50CVE-2026-12747
6.4
Medium
Wordfence PRISMYes
2026-08-31 15:49CVE-2026-19952
7.5
High
nudienYes
2026-08-27 00:00CVE-2026-81346
4.3
Medium
Sai Praneeth KotiYes
Showing 1–10 of 36 reports
ACF Frontend Admin by DynamiApps banner
Latestv3.30.1

ACF Frontend Admin by DynamiApps

Shabti Kaplan

Author

Shabti Kaplan

4.5(160)
90/100
Last Updated
2026-10-13 (15d ago)
Active Installs
8,000+
Downloads
992,793
Requires WP
6.5+
Requires PHP
5.6.0+
Tested up to
WP 7.1.3
Created
2019-09-19 (7y ago)
Requires Plugins
advanced-custom-fields

Add and edit posts, pages, users, terms, ACF fields and more all from the frontend. (Previously called ACF Frontend) This awesome plugin allows you to easily display ACF Frontend Admin forms on your site so your clients can easily edit content by themselves from the frontend. You can create awesome forms with our form builder to allow users to save custom meta data to pages, posts, users, and more. Then use our Gutenberg block or shortcode to easily display these forms for your users. So, what can this plugin do for you? FREE Features No Coding Required Give the end user the best content managment experience without having to know code. It’s all ready to go right here. Display Post Data Use [frontend_admin field=field_key] to display any field value effortlessly Edit Posts Let your users edit posts from the frontend of their site without having to access the WordPress dashboard. Add Posts Let your users publish new posts from the frontend using the “new post” form Delete Posts Let your users delete or trash posts from the frontend using the “trash button” form Edit User Profile Allow users to edit their user data easily from the frontend. User Registration Form Allow new users to register to your site with a built in user registration form! You can even hide the WordPress dashboard from these new users. Hide Admin Area Pick and chose which users have acess to the WordPress admin area. Configure Permissions Choose who sees your form based on user role or by specific users. Modal Popup Display the form in a modal window that opens when clicking a button so that it won’t take up any space on your pages. PRO Features Edit Global Options If you have global data – like header and footer data – you can create an options page using ACF and let your users edit from the frontend. Limit Submits Prevent all or specific users from submitting the form more than a number of times. Send Emails Set emails to be sent and map the ACF form data to display in the email fields such as the email address, the from address, subject, and message. Style Tab Use Elementor to style the form and as well the buttons. Multi Step Forms Make your forms more engaging by adding multiple steps. Stripe and Paypal Accept payments through Stripe or Paypal upon form submission. Woocommerce Intergration Easily add Woocomerce products from the frontend. Purchase your copy here at the official website: ACF Frontend Admin website Intergrations Page Builders ACF Frontend Admin works with all WordPress page builders, including: Elementor Bricks Builder Spectra Website Builder Divi Builder Beaver Builder Thrive Architect Gutenberg Oxygen Builder And others Other Plugins ACF Frontend Admin has built-in integrations with very popular plugins, such as: WooCommmerce Easy Digital Downloads SureCart Advanced Custom Fields Pods And more Useful Links Appreciate what we’re doing? Want to stay updated with new features? Give us a like and follow us on our facebook page: ACF Frontend Admin Facebook page The Pro version has even more cool features. Check it out at the official website: DynamiApps website Check out our other plugin, which let’s you dynamically query your posts more easily: Advanced Post Queries for Elementor Tutorials = The New Post Form Block = https://www.youtube.com/watch?v=SIwiWvPqd8Q = Paul from WPTuts shows how to build a fully functional front-end dashboard in WordPress using the free Front-End Admin plugin and Bricks Builder. https://www.youtube.com/watch?v=O0TYRap8U24 Paul from WP Tuts shows how to use ACF Frontend Admin to create a frontend dashboard Bjorn from WPLearningLab shows how to create a WordPress Client Portal Integrating Bricks Builder with ACF Frontend Admin Frontend Forms in Elementor Pro Off Canvas Widget ACF Frontend Admin’s Elementor Nestable Forms Widget on WordPress Enable Users To Add Content From The Front End Without Logging Into WordPress Using ACF Frontend Admin WordPress Frontend Edits and Updates Using ACF Frontend Admin Installating ACF Frontend Admin How to create a form for frontend data submission

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C