CVE-2026-6226: Frontend Admin by DynamiApps <= 3.29.2 - Unauthenticated Privilege Escalation via Form Configuration Injection
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to unauthenticated privilege escalation in versions up to and including 3.29.2. This is due to insecure form submission handling that accepts arbitrary form definitions from user input instead of securely loading them from the backend. When $_POST['_acf_form'] is an array (rather than a form ID), the validate_form() function bypasses database lookup and directly processes the attacker-controlled structure. The create_record() function preserves attacker-supplied record data if present, and the user action's run() function falls back to attacker-controlled field definitions from $form['fields'] when legitimate fields cannot be found. The role field's pre_update_value() validation reads $field['role_options'] from this attacker-controlled definition, allowing an attacker to specify ['administrator'] as an allowed role and bypass the security check. This makes it possible for unauthenticated attackers to create administrator accounts by injecting a custom form configuration with a spoofed role field.
HarborGuard Analysis
HarborGuard analysisSynopsis
This is an unauthenticated privilege escalation vulnerability in the Frontend Admin by DynamiApps plugin for WordPress, affecting versions up to and including 3.29.2. The flaw is reachable over the network with no login required: an attacker sends a crafted HTTP POST request containing a spoofed form definition that the plugin processes without validating its origin or contents. Successful exploitation allows the attacker to create a new WordPress administrator account, giving full control of the affected site. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment an upstream fix is published.
HarborGuard Coverage
Detection is available across every HarborGuard environment. CVE-2026-6226 is ingested from upstream feeds (including the Wordfence advisory feed) within minutes of publication and matched against all customer images in connected registries and CI/CD pipelines, including custom-built WordPress images that bundle the Frontend Admin plugin.
AvailableHarborGuard scores this finding at CVSS 8.8 HIGH using the published v3.1 vector and applies per-environment compliance policy weighting to determine urgency and routing. Triage results are delivered to the appropriate team inbox within each customer organization based on configured policy rules.
AvailableNo fix version has been published upstream for CVE-2026-6226. HarborGuard re-checks the Wordfence advisory and upstream plugin releases on every ingest cycle and will make a patched-image rebuild available automatically the moment a remediated version is released. For customers who opt into auto-remediation, the rebuild, regression test run, and PR against affected workloads will be triggered without manual intervention.
Pending upstreamExploit Conditions
- Network reachabilityRequired
The vulnerable form submission endpoint is exposed over the network, so an attacker must be able to send HTTP POST requests to the target WordPress installation.
- AuthenticationNot required
No account or session token is needed; the attacker submits the malicious payload as an anonymous HTTP request.
- Victim interactionNot required
The attack is fully server-side and requires no action from any user or administrator of the target site.
- Attack complexityDetail
Exploitation is reliable and condition-free; the attacker simply crafts a POST body with a spoofed form array, and the plugin processes it without any race condition or environmental dependency.
Blast Radius
- Attacker creates a new WordPress user account with the administrator role, gaining full administrative access to the WordPress dashboard.
- With administrator access, the attacker can install or modify plugins and themes, injecting arbitrary PHP code and achieving remote code execution on the host.
- The attacker can read all content stored in the WordPress database, including private posts, user email addresses, password hashes, and any data managed through ACF fields.
- The attacker can modify or delete all site content, user records, and configuration data persisted in the database.
How HarborGuard Handles This
Available on HarborGuard: because no upstream fix exists for CVE-2026-6226 as of publication, the recommended action is to use HarborGuard's advisory monitoring alongside compensating controls at the infrastructure layer. Network policy isolation (restricting inbound HTTP access to the WordPress installation to known IP ranges where possible) and web application firewall rules that reject POST requests where the _acf_form parameter is an array rather than a scalar ID can reduce exposure without requiring a plugin update. HarborGuard re-checks the Wordfence advisory feed and the WordPress plugin repository on every ingest cycle. The moment the DynamiApps maintainers ship a patched release, a rebuilt image at the fix version becomes available. For customers who opt into auto-remediation, the rebuild is followed by an automated regression test run and a PR opened against affected workloads, with no manual steps required.
Metrics
- CVSS v3.1
- 8.8
- Severity
- HIGH
- Fixed in
- —
- Affected Products
- 1
- shabti / Frontend Admin by DynamiApps≤ 3.29.2
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H