CVE-2026-81343CWE-862broken-access-control

CVE-2026-81343

Medium · published October 17, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
6.8
In the wild
Unconfirmed
What it is

The ACF Frontend Admin by DynamiApps WordPress plugin through 3.29.13 does not perform a capability check on one of its form-submission actions before writing submitted values into the site's global ACF options store, allowing unauthenticated visitors to overwrite site-wide option values via a public form.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00176 · 6.8th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-10-17T10:16Z
References (1)
https://wpscan.com/vulnerability/1919eb80-195e-48ed-b58e-3cab4bb1d73d/ · [email protected]
EPSS history
Timeline
  • 18 OCT 03:32Z
    EPSS moved — → 0%
    epss
  • 17 OCT 06:00Z
    Frontend Admin by DynamiApps <= 3.29.13 - Unauthenticated ACF Options Page Field Update via Form Submission
    cvelistv5
  • 17 OCT 06:00Z
    Frontend Admin by DynamiApps <= 3.29.13 - Unauthenticated ACF Options Page Field Update via Form Submission
    cvelistv5