# ACF Frontend Admin by DynamiApps

> This awesome plugin allows you to easily display frontend forms on your site so your clients can easily edit content by themselves from the frontend.

Source: https://todaywp.com (Today WP, free and read-only). Refreshed 2026-11-09 17:54 UTC.

## Facts (WordPress.org)

- Slug: `acf-frontend-form-element`
- Author: Shabti Kaplan
- Version: 3.30.2
- Active installs: 8,000+
- Last update: 2026-11-01 (9 days ago)
- Tested up to: WordPress 7.1.4 (current: 7.1.4)
- Requires: WordPress 6.5, PHP 5.6.0
- Tags: acf frontend, custom dashboard, custom fields, frontend editing, frontend posting
- Page: https://wordpress.org/plugins/acf-frontend-form-element/

## Checks (against WordPress 7.1.4)

- OK: Updated 9 days ago.
- OK: Tested with WordPress 7.1.
- OK: Runs on any PHP WordPress supports (PHP 7.4+).

## Agent Signals

No agent reports yet. Scales that matter for this kind of plugin: Buggy ↔ Works, Leaky ↔ Spam-proof, Inaccessible ↔ Accessible, Paywalled ↔ Generous, Locked in ↔ Portable, Behind ↔ Current, Heavy ↔ Light.

## Known vulnerabilities

- 2026-11-09 CRITICAL: Incorrect Privilege Assignment (up to 3.30.1). CVE-2026-119506, https://patchstack.com/database/wordpress/plugin/acf-frontend-form-element/vulnerability/wordpress-frontend-admin-by-dynamiapps-plugin-3-30-1-privilege-escalation-vulnerability?_s_id=cve
- 2026-10-17 MEDIUM: Missing Authorization (up to 3.29.0). CVE-2026-81343, https://www.wordfence.com/threat-intel/vulnerabilities/id/68f5ff96-e8e1-4cbf-b42d-13c99d903a9f?source=api-prod
- 2026-10-17 MEDIUM: Authenticated (Administrator+) PHP Object Injection (up to 3.29.0). CVE-2026-81344, https://www.wordfence.com/threat-intel/vulnerabilities/id/936041b9-3448-4494-94d7-e3d646caa448?source=api-prod
- 2026-10-15 HIGH: Unauthenticated Privilege Escalation (up to 3.29.13). CVE-2026-109892, https://www.wordfence.com/threat-intel/vulnerabilities/id/9af247aa-430d-4a88-953e-0dbda6f9f21f?source=api-prod
- 2026-10-10 MEDIUM: Authenticated (Administrator+) SQL Injection (up to 3.29.13). CVE-2026-42722, https://www.wordfence.com/threat-intel/vulnerabilities/id/a108d88f-bbba-4e6e-8000-977e32c370a1?source=api-prod
- 2026-10-10 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via Post Content (up to 3.28.36). CVE-2026-6243, https://www.wordfence.com/threat-intel/vulnerabilities/id/9efd645d-817c-4148-b62f-86be90c543b4?source=api-prod
- 2026-09-06 CRITICAL: Unauthenticated Account Takeover via '_acf_objects' Object Identifier (up to 3.29.12). CVE-2026-75816, https://www.wordfence.com/threat-intel/vulnerabilities/id/f1637a3b-7b0f-485d-9d19-4f711f8c671b?source=api-prod
- 2026-09-04 HIGH: Unauthenticated Path Traversal (up to 3.29.12). CVE-2026-81347, https://www.wordfence.com/threat-intel/vulnerabilities/id/7e867285-511b-45e4-9732-73cbdbe7bccb?source=api-prod
- 2026-09-01 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via 'tag' Shortcode Attribute (up to 3.29.11). CVE-2026-12747, https://www.wordfence.com/threat-intel/vulnerabilities/id/bcfbce25-af5f-45dc-a7e1-922d3a549359?source=api-prod
- 2026-09-01 HIGH: Unauthenticated Arbitrary File Deletion via Path Traversal via custom_directory_name Merge Tag (up to 3.29.12). CVE-2026-19952, https://www.wordfence.com/threat-intel/vulnerabilities/id/55ec5101-6494-4180-9492-03863e839ad2?source=api-prod
- 2026-08-29 MEDIUM: Authenticated (Subscriber+) Membership Plan Deletion (before 3.29.11). CVE-2026-81346, https://www.wordfence.com/threat-intel/vulnerabilities/id/033e9370-368d-4ffa-be6d-3a75e62aa86f?source=api-prod
- 2026-08-18 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 3.29.10). CVE-2026-66638, https://www.wordfence.com/threat-intel/vulnerabilities/id/d7285cfb-faba-4769-8f2e-9e14e6af604d?source=api-prod
- 2026-08-16 CRITICAL: Unauthenticated Privilege Escalation via 'item_id' Parameter (up to 3.29.9). CVE-2026-18432, https://www.wordfence.com/threat-intel/vulnerabilities/id/01404fad-7b5a-485a-b557-c608fe25e6c9?source=api-prod
- 2026-08-11 HIGH: Authenticated (Subscriber+) Arbitrary Password Reset via Encrypted Object Token (up to 3.29.9). CVE-2026-15606, https://www.wordfence.com/threat-intel/vulnerabilities/id/e5aa9b71-67e4-4049-8dd4-23b76dbd87bb?source=api-prod
- 2026-08-06 MEDIUM: Missing Authorization (up to 3.29.10). CVE-2026-66470, https://www.wordfence.com/threat-intel/vulnerabilities/id/66b5662a-0be7-43f5-b055-02b3cd3a44d1?source=api-prod
- 2026-08-06 CRITICAL: Unauthenticated Privilege Escalation (up to 3.29.12). CVE-2026-66662, https://www.wordfence.com/threat-intel/vulnerabilities/id/2e1ab5a7-0be8-444d-8680-68b3b0be6edf?source=api-prod
- 2026-07-31 HIGH: Unauthenticated Stored Cross-Site Scripting (up to 3.29.8). CVE-2026-13609, https://www.wordfence.com/threat-intel/vulnerabilities/id/3150bdc4-fe5d-47ca-bb52-338853e3e23d?source=api-prod
- 2026-07-30 MEDIUM: Missing Authorization (before 3.29.7). CVE-2026-11867, https://www.wordfence.com/threat-intel/vulnerabilities/id/5483980a-3478-4bfa-9571-67b8bd6f3f4d?source=api-prod
- 2026-05-29 MEDIUM: Authenticated (Administrator+) SQL Injection via 'order' Parameter (up to 3.28.8). CVE-2026-10039, https://www.wordfence.com/threat-intel/vulnerabilities/id/51d79701-8580-4130-8f84-e739aa2f7f5f?source=api-prod
- 2026-05-28 HIGH: Missing Authorization to Authenticated (Subscriber+) Account Takeover via 'user_id' URL Query Parameter (up to 3.29.2). CVE-2026-7802, https://www.wordfence.com/threat-intel/vulnerabilities/id/cd091bd5-6b6a-4964-9249-525bbbec702c?source=api-prod
- 2026-05-28 HIGH: Unauthenticated Privilege Escalation via Form Configuration Injection (up to 3.29.2). CVE-2026-6226, https://www.wordfence.com/threat-intel/vulnerabilities/id/123e1758-3384-4ea7-96dd-d6adcce40392?source=api-prod
- 2026-05-15 HIGH: Unauthenticated Privilege Escalation via Edit User Form (up to 3.28.36). CVE-2026-6228, https://www.wordfence.com/threat-intel/vulnerabilities/id/083accd0-8338-47c6-b396-96679b95dd40?source=api-prod
- 2026-03-25 HIGH: Authenticated (Editor+) PHP Object Injection via 'post_content' of Admin Form Posts (up to 3.28.31). CVE-2026-3328, https://www.wordfence.com/threat-intel/vulnerabilities/id/0faa8f07-88c1-4638-9de5-e202807866e1?source=api-prod
- 2026-01-08 CRITICAL: Unauthenticated Privilege Escalation to Administrator via Role Form Field (up to 3.28.29). CVE-2025-14736, https://www.wordfence.com/threat-intel/vulnerabilities/id/07eb71fc-6588-490d-8947-3077ec4a9045?source=api-prod
- 2026-01-08 HIGH: Unauthenticated Stored Cross-Site Scripting via 'update_field' (up to 3.28.23). CVE-2025-14937, https://www.wordfence.com/threat-intel/vulnerabilities/id/46c988ff-9cc5-4f2b-a3dd-06eaef5a7919?source=api-prod
- 2026-01-08 CRITICAL: Missing Authorization to Unauthenticated Arbitrary Data Deletion via 'delete post' Form Element (up to 3.28.25). CVE-2025-14741, https://www.wordfence.com/threat-intel/vulnerabilities/id/53adbab6-953a-4a6f-bbfc-89efdbdd28e0?source=api-prod
- 2025-12-03 CRITICAL: Unauthenticated Arbitrary Options Update (up to 3.28.20). CVE-2025-13342, https://www.wordfence.com/threat-intel/vulnerabilities/id/613f2035-3061-429b-b218-83805287e4f3?source=api-prod
- 2025-08-12 MEDIUM: Authenticated (Subscriber+) SQL Injection (up to 3.28.3). CVE-2025-49267, https://www.wordfence.com/threat-intel/vulnerabilities/id/b0aec8f4-9c22-4e44-989b-359442c1e6c7?source=api-prod
- 2025-06-26 MEDIUM: Authenticated (Editor+) Arbitrary File Deletion (up to 3.28.7). CVE-2025-49303, https://www.wordfence.com/threat-intel/vulnerabilities/id/8156d204-f48a-43aa-af2f-86d4aaf4f50e?source=api-prod
- 2025-02-23 MEDIUM: Reflected Cross-Site Scripting (up to 3.25.17). CVE-2025-26987, https://www.wordfence.com/threat-intel/vulnerabilities/id/3302cb58-e5d7-4c15-9f2d-f8951c32451e?source=api-prod
- 2024-12-20 MEDIUM: Unauthenticated SQL Injection (up to 3.25.1). CVE-2024-11722, https://www.wordfence.com/threat-intel/vulnerabilities/id/97cef309-da2f-461a-b5a3-3a85c540c7aa?source=api-prod
- 2024-12-13 HIGH: Unauthenticated Stored Cross-Site Scripting (up to 3.24.5). CVE-2024-11720, https://www.wordfence.com/threat-intel/vulnerabilities/id/69a464f4-c357-446f-a5b8-0919d9af56c9?source=api-prod
- 2024-12-13 HIGH: Unauthenticated Privilege Escalation (up to 3.24.5). CVE-2024-11721, https://www.wordfence.com/threat-intel/vulnerabilities/id/e9fdc833-8384-42c0-ad9b-72e5b6351964?source=api-prod
- 2024-04-18 CRITICAL: Improper Missing Encryption Exception Handling to Form Manipulation (up to 3.19.4). CVE-2024-3729, https://www.wordfence.com/threat-intel/vulnerabilities/id/a2d22c5d-5ef5-4920-a1b5-e8284394c7e8?source=api-prod
- 2023-12-27 CRITICAL: Unauthenticated Arbitrary File Upload (up to 3.18.3). CVE-2023-51411, https://www.wordfence.com/threat-intel/vulnerabilities/id/7815322d-a240-4855-b458-60caa3cec96c?source=api-prod
- 2023-07-18 MEDIUM: Reflected Cross-Site Scripting via fs_request_get (up to 3.7.11). WF-5253fe2b-040b-417c-b257-0cb59ee5aa6e-185, https://www.wordfence.com/threat-intel/vulnerabilities/id/5253fe2b-040b-417c-b257-0cb59ee5aa6e?source=api-prod
- 2022-03-04 MEDIUM: Missing Authorization Checks (before 3.3.33). WF-39fb0499-9ab4-4a2f-b0db-ece86bcf4d42-108, https://www.wordfence.com/threat-intel/vulnerabilities/id/39fb0499-9ab4-4a2f-b0db-ece86bcf4d42?source=api-prod

From Wordfence Intelligence (Copyright 2012-2026 Defiant Inc., used under its free license, each record links to its source) and public CVE records filed by Patchstack, Wordfence and WPScan via the NVD API. This product uses the NVD API but is not endorsed or certified by the NVD.

Compare: https://todaywp.com/plugins/compare?slugs=acf-frontend-form-element · HTML: https://todaywp.com/plugins/acf-frontend-form-element