WordPress plugin
ACF Frontend Admin by DynamiApps security & vulnerabilities
Unpatched vulnerability in the latest version
At least one vulnerability affects the latest version and no fix has been released. Deactivate the plugin or restrict access to the affected feature until the vendor ships a patch.
- Critical8
- High14
- Medium16
- Low0
All ACF Frontend Admin by DynamiApps vulnerabilities
- High7.2Unauthenticated Stored Cross-Site Scripting
≤3.30.1Update to 3.30.2
- High7.3Unauthenticated Privilege Escalation
≤3.30.1Update to 3.30.2
- High7.3Unauthenticated Privilege Escalation
≤3.29.13Update to 3.30.0
- Critical9.8Unauthenticated Account Takeover via '_acf_objects' Object Identifier
≤3.29.12Update to 3.29.13
- High8.2Unauthenticated Path Traversal
≤3.29.12Update to 3.29.13
- High7.5Unauthenticated Arbitrary File Deletion via Path Traversal via custom_directory_name Merge Tag
≤3.29.12Update to 3.29.13
- Critical9.8Unauthenticated Privilege Escalation via 'item_id' Parameter
≤3.29.9Update to 3.29.10
- High8.8Authenticated (Subscriber+) Arbitrary Password Reset via Encrypted Object Token
≤3.29.9Update to 3.29.10
- Critical9.8Unauthenticated Privilege Escalation
≤3.29.12Update to 3.29.13
- High7.2Unauthenticated Stored Cross-Site Scripting
≤3.29.8Update to 3.29.9
- High8.8Missing Authorization to Authenticated (Subscriber+) Account Takeover via 'user_id' URL Query Parameter
≤3.29.2Update to 3.29.3
- High8.8Unauthenticated Privilege Escalation via Form Configuration Injection
≤3.29.2Update to 3.29.3
- High8.8Unauthenticated Privilege Escalation via Edit User Form
≤3.28.36Update to 3.29.1
- High7.2Authenticated (Editor+) PHP Object Injection via 'post_content' of Admin Form Posts
≤3.28.31Update to 3.28.32
- High7.2Unauthenticated Stored Cross-Site Scripting via 'update_field'
≤3.28.23Update to 3.28.24
- Critical9.1Missing Authorization to Unauthenticated Arbitrary Data Deletion via 'delete post' Form Element
≤3.28.25Update to 3.28.26
- Critical9.8Unauthenticated Privilege Escalation to Administrator via Role Form Field
≤3.28.29Update to 3.28.30
- Critical9.8Unauthenticated Arbitrary Options Update
≤3.28.20Update to 3.28.21
- High7.2Unauthenticated Stored Cross-Site Scripting
≤3.24.5Update to 3.25.1
- High8.1Unauthenticated Privilege Escalation
≤3.24.5Update to 3.25.1
- Critical9.8Improper Missing Encryption Exception Handling to Form Manipulation
≤3.19.4Update to 3.19.5
- Critical9.8Unauthenticated Arbitrary File Upload
≤3.18.3Update to 3.18.4
ACF Frontend Admin by DynamiApps: common questions
Does ACF Frontend Admin by DynamiApps have known vulnerabilities?
Yes. VulnCrest Radar lists 38 known vulnerabilities in ACF Frontend Admin by DynamiApps: 8 critical, 14 high, 16 medium. At least one is not fixed in the latest version.
How do I check which version of ACF Frontend Admin by DynamiApps I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent ACF Frontend Admin by DynamiApps vulnerability?
CVE-2026-119504, published Nov 7, 2026: ACF Frontend Admin by DynamiApps <= 3.30.1 - Unauthenticated Stored Cross-Site Scripting. Severity: High (CVSS 7.2).
Is any ACF Frontend Admin by DynamiApps vulnerability listed in CISA KEV?
No. None of the known ACF Frontend Admin by DynamiApps vulnerabilities is currently listed in the CISA KEV catalog.