Frontend Admin plugin auth bypass allows WordPress account takeover
A CVSS 9.8 auth bypass in the Frontend Admin WordPress plugin allows unauthenticated account takeover in all versions through 3.29.12.
- Vendor
- DynamiApps
- Product
- Frontend Admin (acf-frontend-form-element)
- CVSS
- 9.8
- EPSS (exploit probability)
- 0.9%
- Status
- unpatched
- Published
Is CVE-2026-75816 being exploited?
Not on any exploited-vulnerability catalog we track. CVE-2026-75816 was not on the CISA, ENISA or CIRCL exploited catalogs as of our 2026-10-23 snapshot. That can change quickly; check the write-up below for the latest reporting.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 0.9% (scored October 14, 2026).
- CISA KEV[ — ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-10-23. Full cross-catalog view: /kev-comparison
CVE-2026-75816 timeline
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
The Frontend Admin plugin for WordPress, developed by DynamiApps and distributed as acf-frontend-form-element, contains an authentication bypass in the email field update handler (class-user-email.php). The pre_update_value hook does not properly verify account ownership, allowing an unauthenticated attacker to modify an account’s email address and take full control of that account.
All versions through 3.29.12 are affected. A patched version had not been confirmed at time of publication. Site operators should check the plugin’s WordPress.org changelog for a release newer than 3.29.12.
