The plugin ACF Frontend Admin by DynamiApps for WordPress, versions up to 3.29.13, fails to perform a capability check when a form submission is processed. The unrestricted write to the site‑wide ACF options store allows any visitor, without authentication, to overwrite global configuration values. This results in unauthorized modification of site settings, potentially changing theme behavior, disabling security features, or facilitating further exploitation. The underlying weakness is a lack of access control.

WordPress sites that have installed the ACF Frontend Admin by DynamiApps plugin, specifically any deployment using version 3.29.13 or earlier. The plugin vendor is unknown, but the affected product is identified by the CNA as "ACF Frontend Admin by DynamiApps".

The vulnerability is easy to exploit because it requires only the submission of a crafted form that targets the ACF options page. An attacker does not need any credentials or elevated privileges. Although the CVSS and EPSS scores are not provided, the lack of an authentication requirement makes the risk high for sites that rely on the default settings of this plugin. The vulnerability is not listed in CISA's KEV catalog, but its potential impact on configuration integrity makes it a priority for remediation.