---
id: CVE-2026-81343
title: >-
  Frontend Admin by DynamiApps <= 3.29.13 - Unauthenticated ACF Options Page
  Field Update via Form Submission
summary: >-
  The ACF Frontend Admin by DynamiApps WordPress plugin through 3.29.13 does not
  perform a capability check on one of its form-submission actions before
  writing submitted values into the site's global ACF options store, allowing
  unauthenti…
severity: none
cwe:
  - CWE-862
product: ACF Frontend Admin by DynamiApps
affected:
  - acf_frontend_admin_by_dynamiapps <= 3.29.13
published: '2026-10-17'
updated: '2026-10-17'
sourceUpdated: '2026-10-17T06:00:14.821Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-81343'
references:
  - url: 'https://wpscan.com/vulnerability/1919eb80-195e-48ed-b58e-3cab4bb1d73d/'
tags:
  - cve.org
ingestedAt: '2026-10-17T07:01:26.048Z'
---

## Overview

The ACF Frontend Admin by DynamiApps WordPress plugin through 3.29.13 does not perform a capability check on one of its form-submission actions before writing submitted values into the site's global ACF options store, allowing unauthenticated visitors to overwrite site-wide option values via a public form.

## Affected

- `acf_frontend_admin_by_dynamiapps <= 3.29.13`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.