Quick Look: CVE-2026-7802 — Frontend Admin by DynamiApps Authorization Bypass Enables Full Admin Account Takeover

Introduction

A missing authorization check in the Frontend Admin by DynamiApps WordPress plugin lets any authenticated subscriber overwrite an administrator's password and email address, taking over the account with nothing more than a changed URL parameter. The plugin has 20,000+ active installations and a design that puts admin form handlers on the public frontend on purpose. This is its third CWE-862 vulnerability in six months, which raises real questions about how it handles access control.

Frontend Admin by DynamiApps (plugin slug: acf-frontend-form-element) is a WordPress plugin that shows admin editing forms on the frontend of a site, so users can create and edit posts, users, and other content without touching the WordPress dashboard. It integrates with Advanced Custom Fields (ACF) and is marketed as a tool to "turn your site into a lucrative Platform as a Service." The plugin has over 20,000 active installations according to the WordPress.org plugin page.

Technical Information

Vulnerability Classification

CVE-2026-7802 falls under CWE-862: Missing Authorization, which MITRE defines as a condition where "the software does not perform an authorization check when an actor attempts to access a resource or perform an action." The distinction matters here: the plugin does confirm the user is logged in (authentication), but it never checks whether that logged-in user has permission to modify the target account (authorization).

The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, for a score of 8.8. Breaking this down:

• AV:N: Exploitable remotely over the network
• AC:L: No special conditions, race windows, or exploit chaining required
• PR:L: Subscriber-level access is enough (the lowest WordPress role)
• UI:N: The target administrator does not have to do anything
• C:H/I:H/A:H: Full compromise of confidentiality, integrity, and availability

Root Cause

The vulnerability lives in the plugin's form submission and user profile update handlers. The affected code spans four locations:

When it processes an Edit User form submission, the plugin reads a user_id parameter straight from the URL query string (?user_id=) and uses it to decide which account to modify. The defect is that no authorization check confirms whether the authenticated user can edit the account named by that user_id value. A subscriber can supply any user ID, including an administrator's, and the plugin will process the form submission against that account.

The fields that can be overwritten include user_pass, user_email, first_name, last_name, and other standard WordPress profile fields.

Attack Flow

Prerequisites: The attacker needs a subscriber-level WordPress account on the target site (available through open registration if it is enabled), and the site must have at least one Edit User form with its "Roles" configuration setting left empty.

Attack Path 1: Direct Password Replacement

1. The attacker authenticates as a subscriber.
2. The attacker finds an administrator's user ID. In WordPress, the first administrator account is usually user ID 1, so this is easy to guess.
3. The attacker navigates to a frontend Edit User form that has an empty Roles configuration.
4. The attacker appends ?user_id=1 (or the target admin's ID) to the form URL.
5. The attacker submits the form with a new value in the user_pass field.
6. The plugin processes the submission with no authorization check and replaces the administrator's password.
7. The attacker logs in as the administrator with the new password.

Attack Path 2: Email Redirect Password Reset

1. Steps 1 through 4 are identical to Attack Path 1.
2. Instead of modifying user_pass, the attacker changes the user_email field to an email address they control.
3. The attacker then uses WordPress's standard password reset flow, which sends a reset link to the now attacker-controlled email address.
4. The attacker completes the password reset and gains administrator access.

The second path may be better when the form does not expose the user_pass field but does expose user_email.

Exploitability Constraint

One constraint limits how far exploitation can go: the targeted Edit User form must have its Roles configuration setting left empty. When a non-empty roles list is configured on the form, the load_data() function checks the target user's role against the allowed list. If the target user's role (e.g., administrator) is not in that list, load_data() sets the user ID to none, which stops the form from loading or modifying that user's data.

So sites where every Edit User form has a properly configured roles list are not exploitable through this specific vulnerability. But the default or unconfigured state (empty roles) is the vulnerable one, and administrators who do not know about this setting may leave it empty.

Discovery and Disclosure

Security researcher Tiago Ventura (perses) discovered the vulnerability and disclosed it through Wordfence's vulnerability reporting program. The CVE was published to NVD on May 28, 2026. The fix is documented in WordPress Trac changeset 3525193.

Affected Systems and Versions

• Plugin: Frontend Admin by DynamiApps (slug: acf-frontend-form-element)
• Affected versions: All versions up to and including 3.29.2
• Patched version: 3.29.3
• Vulnerable configuration: Edit User forms with the "Roles" configuration setting left empty. Forms with a non-empty roles list configured are not exploitable for targeting users outside the specified roles.
• Required attacker privilege: Authenticated user with subscriber-level access or above
• Platform: WordPress

The vulnerability is confirmed present in source code for tags 3.28.36, 3.29.1, and trunk, as documented in the WordPress Trac references.

Vendor Security History

The Frontend Admin by DynamiApps plugin has built up a notable vulnerability history, especially around CWE-862 Missing Authorization flaws. The known vulnerabilities:

Three of these six vulnerabilities are CWE-862 Missing Authorization flaws, and two of those carried critical CVSS 9.8 scores. The pattern is clear: each patch fixes the specific endpoint where authorization was omitted, but the plugin has no central authorization enforcement layer. New endpoints and code paths keep appearing with the same defect.

Wordfence reported that 3 attacks were blocked within 24 hours targeting CVE-2025-13342 at the time of its disclosure, which shows that attackers watch for and exploit this plugin's authorization flaws soon after public disclosure.

The plugin was also referenced in the CISA Vulnerability Summary for the week of January 5, 2026 (bulletin SB26-012), which reflects federal-level attention to its earlier vulnerabilities.

One trend stands out in the history: CVE-2025-13342 and CVE-2025-14736 both required zero authentication (PR:N, CVSS 9.8), while CVE-2026-7802 requires subscriber-level access (PR:L, CVSS 8.8). This suggests the vendor has partly improved authentication checks but keeps failing on authorization enforcement after authentication, which points back to the same conclusion: the plugin's access control model is fundamentally incomplete.

For organizations weighing continued use of this plugin, three high or critical severity authorization bypasses in six months is reason to look seriously at alternative frontend form solutions that treat capability checks as a foundational design principle.

References

• NVD: CVE-2026-7802
• Wordfence Advisory: Frontend Admin by DynamiApps <= 3.29.2 Missing Authorization
• WordPress Plugin Page: Frontend Admin by DynamiApps
• WordPress Trac: actions/user.php L565 (tag 3.29.1)
• WordPress Trac: actions/user.php L636 (tag 3.29.1)
• WordPress Trac: classes/submit.php L110 (tag 3.29.1)
• WordPress Trac: classes/submit.php L392 (tag 3.29.1)
• WordPress Trac: Changeset 3525193
• Patchstack: Frontend Admin Vulnerability History
• Wordfence Advisory: CVE-2025-13342 (Unauthenticated Arbitrary Options Update)
• WP Firewall Advisory: CVE-2025-14736 (Privilege Escalation)
• SentinelOne: CVE-2026-3328 (PHP Object Injection)
• FreshySites: CVE-2026-6228 Security Bulletin
• CWE-862: Missing Authorization
• DynamiApps Official Website
• CISA Vulnerability Summary: Week of January 5, 2026 (SB26-012)