The ACF Frontend Admin by DynamiApps WordPress plugin, up to version 3.29.13, does not perform a capability check on one of its form‑submission actions before writing submitted values into the site’s global ACF options store. Because submitted data is written directly to those options without verifying the user’s permissions, an attacker can overwrite any site‑wide option value. This unauthorized change can alter theme behavior, disable security settings, or otherwise compromise the configuration of the website, thereby impacting the integrity of the system.

WordPress installations that have the ACF Frontend Admin by DynamiApps plugin installed, specifically using any version 3.29.13 or earlier. The vendor is listed as Unknown:ACF Frontend Admin by DynamiApps. Any site that relies on this plugin for front‑end form functionality may be affected.

Exploiting the flaw requires only the submission of a crafted form; no authentication or elevated privileges are needed. The CVSS score of 5.3 reflects a moderate severity, while the EPSS score of less than 1% indicates a low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attacker can manipulate global settings by targeting the options page, making the risk moderate for sites that do not restrict the form to privileged users.