BREAKING: CVE-2026-18432 - Frontend Admin by DynamiApps Allows Unauthenticated Administrator Takeover

TL;DR: Frontend Admin by DynamiApps for WordPress is vulnerable to a privilege-escalation flaw that can let an unauthenticated attacker take over the default administrator account when a public-facing frontend user form is present. The vulnerable code only performs its current_user_can('edit_user', $user_id) authorization check when $user_id is numeric. A crafted non-numeric item_id such as 1one skips that check, is carried inside a server-signed _acf_objects payload, and is later coerced by WordPress to integer 1, allowing the attacker to change that administrator's password or email. CVE-2026-18432 is CVSS 9.8 Critical. Versions through 3.29.9 are affected. Update to 3.29.10 or later.

What happened

The issue is in Frontend Admin's user-action authorization path. The plugin's ActionUser::conditions_logic() method is supposed to ensure the current caller can edit the target WordPress user before sensitive user fields are changed.

That check is incorrectly gated by is_numeric($user_id). If the attacker supplies a string that is not considered numeric, the capability check is not executed at all.

The public AJAX handler wp_ajax_nopriv_frontend_admin/forms/change_form accepts an item_id value used to build the frontend form state. A value such as 1one is non-numeric at the authorization gate, so the plugin skips current_user_can('edit_user', ...). The value can then be included in the plugin's server-signed _acf_objects form payload.

Later in the request path, WordPress user APIs coerce that crafted identifier to integer 1. On a typical WordPress installation, user ID 1 is the original administrator. The attacker can therefore submit password or email changes against that account even though the earlier authorization check was skipped.

Who is exposed

WordPress.org currently reports more than 9,000 active installations of Frontend Admin by DynamiApps. The plugin is specifically designed to expose user-registration and user-editing workflows on the frontend, which is also what makes this bug operationally important.

Wordfence's CNA record says unauthenticated exploitation requires a public-facing frontend user form to be configured. If that condition is not present, a subscriber-level account is sufficient to reach the vulnerable path.

The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, producing a 9.8 Critical score.

Affected and fixed versions

• Affected: Frontend Admin by DynamiApps through 3.29.9.
• Patched target: 3.29.10 or later.

WordPress.org currently lists 3.29.10 as the latest release. Sites running 3.29.9 or older should update immediately.

What to do

Update the plugin from WordPress Admin or with WP-CLI:

wp plugin update acf-frontend-form-element

Verify the installed version:

wp plugin get acf-frontend-form-element --field=version

The result should be 3.29.10 or newer. If you cannot patch immediately, disable public frontend user-editing and registration forms, or deactivate the plugin:

wp plugin deactivate acf-frontend-form-element

After patching, review administrator accounts for unexpected email or password changes and inspect requests to admin-ajax.php involving frontend_admin/forms/change_form. Pay particular attention to suspicious non-numeric item_id values.

Why this matters

This is not a generic WordPress permission mistake. The vulnerable branch converts a type-checking decision into an authorization bypass: an attacker deliberately chooses an identifier that is non-numeric when permissions are checked but becomes a valid administrator user ID later in the flow.

That gives defenders a useful detection clue and makes rapid patching important. A successful attacker who resets an administrator password or email can take full control of the site, install plugins, modify themes, create persistence, and access business data managed through WordPress.

References

• CVE-2026-18432 CNA record from Wordfence
• Wordfence vulnerability record
• Frontend Admin by DynamiApps on WordPress.org
• WordPress plugin patch changeset
• HOL Guard CVE evidence page