Frontend Admin Plugin Flaw Allows WordPress Account Takeover

A critical authentication bypass in the Frontend Admin by DynamiApps WordPress plugin allows an unauthenticated attacker to take over any user account on an affected site. The vulnerability, CVE-2026-75816, carries a CVSS score of 9.8. The flaw is in the plugin’s email field update code: the pre_update_value hook in class-user-email.php does not properly verify that the requesting party owns the account being modified, leaving a path from unauthenticated request to full account control.

All versions up to and including 3.29.12 are affected. The plugin is distributed on WordPress.org under the slug acf-frontend-form-element. No exploitation in the wild has been confirmed at time of publication.

Frontend Admin lets site operators expose editing and account management workflows to front-end users without granting back-end dashboard access. An attacker who can take over an account through that front-end layer gains every privilege that account holds: the ability to publish or modify content, access order history on e-commerce sites, or trigger any other authenticated action the account is permitted to perform.

What to do. Update the Frontend Admin plugin. Check the plugin changelog for a version released after 3.29.12 and install it. Sites that allow public-facing account management through this plugin should treat this as an urgent update.

CVE-2026-75816 on NVD

Related: All-in-One WP Migration Flaw Hits 3M WordPress Sites · Elementor Pro Flaw Exploited to Backdoor WordPress Sites · Profile Builder Plugin Flaw Allows Unauth File Upload · miniOrange SAML WordPress Flaws Under Active Exploit