{"id":"CVE-2026-119506","published":"2026-11-09T01:17:01.197","lastModified":"2026-11-09T15:17:07.273","description":"Incorrect Privilege Assignment vulnerability in DynamiApps Frontend Admin by DynamiApps acf-frontend-form-element allows Privilege Escalation.This issue affects Frontend Admin by DynamiApps: from n/a through 3.30.1.","cvssScore":9.1,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cwes":["CWE-266"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/acf-frontend-form-element/vulnerability/wordpress-frontend-admin-by-dynamiapps-plugin-3-30-1-privilege-escalation-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The DynamiApps Frontend Admin plugin contains a privilege assignment flaw (CWE-266) that allows unauthenticated or low-privileged users to gain elevated administrative privileges via the acf-frontend-form-element functionality. This enables unauthorized access to sensitive admin features and data manipulation.","exploitability":"Exploitation likely requires no authentication and minimal skill due to the CVSS vector indicating network accessibility, low attack complexity, and no user interaction required.","blast_radius":"Successful exploitation could lead to full compromise of WordPress admin functionality, including unauthorized content modification, user privilege escalation, and access to sensitive backend data.","remediation":"Upgrade to version 3.30.2 or later, as the description indicates the vulnerability affects versions from n/a through 3.30.1.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["privilege-escalation","web","wordpress-plugin","auth-bypass"],"model":"garnet-coder","analyzedAt":"2026-11-09T09:45:34.038Z"}}