An incorrect privilege assignment flaw exists in the Shabti Kaplan Frontend Admin by DynamiApps acf-frontend-form-element plugin, allowing an attacker to elevate privileges on a WordPress site. The weakness lies in the CMS plugin’s handling of user capabilities, a classic example of the CWE‑266 vulnerability class, where insufficient control over role assignments leads to unauthorized access rights.

The affected product is the WordPress plugin Frontend Admin by DynamiApps, also known as acf-frontend-form-element, developed by Shabti Kaplan. All releases up through version 3.29.13 are vulnerable; newer releases are not impacted.

The CVSS score of 9.8 indicates a critical severity, but the EPSS score of less than 1% suggests a low likelihood of exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is via the WordPress frontend, where an authenticated user with lower privileges can manipulate the plugin’s privilege assignment logic to gain elevated rights.