Patchstack, the CNA that assigned the CVE, lists the required privilege as unauthenticated and scores it CVSS 3.1 9.1 Critical. The plugin is fixed in version 3.30.2.
What it allows
CVE-2026-119506 is an incorrect privilege assignment flaw in the WordPress plugin Frontend Admin by DynamiApps, listed on WordPress.org under the slug acf-frontend-form-element. The plugin lets site owners build front-end forms so logged-in users can create or edit content without using the admin dashboard.
Patchstack, the CVE Numbering Authority partner that assigned CVE-2026-119506, lists the required privilege as unauthenticated. That means the record does not require an attacker to hold any account on the site before gaining the extra privilege.
CVE-2026-119506: What Patchstack's Record Says
The CVE record classifies the bug as CWE-266, Incorrect Privilege Assignment. The CVE record also maps it to CAPEC-233, Privilege Escalation. Patchstack's own database separately classifies it under OWASP category A7, Identification and Authentication Failures. Patchstack's bug bounty program credits Nguyen Quang Tan as the finder, with the report dated 24 October 2026 and public disclosure on 6 November 2026.
How the Score Reads
Patchstack scores it CVSS 3.1 9.1 Critical, vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. That vector means a network attack, low complexity, no privileges and no user interaction required. NVD lists Patchstack's score as secondary, and there is no CVSS 4.0 score in the record or NVD.
Patchstack's standard guidance for vulnerabilities scored this high says they are expected to become exploited and are used in mass-exploit campaigns that hit many sites at once, regardless of size. This is Patchstack's general severity-tier language, not a case-specific claim about CVE-2026-119506.
What CISA KEV Says
As of CISA catalog version 2026.11.06, CVE-2026-119506 is not in the Known Exploited Vulnerabilities catalog. We checked the catalog on 9 November 2026, the same day the CVE record and NVD entry were published.
Who is affected
The CVE record lists Frontend Admin by DynamiApps as affected from an unspecified early version through 3.30.1. Patchstack's page gives the same ceiling and names 3.30.2 as the patched release.
Patchstack's solution field says to update the plugin to at least version 3.30.2. We did not open the plugin's own changelog for this page, so we describe only what Patchstack's record states.
Patchstack's bug bounty program credits Nguyen Quang Tan as the finder. See our patch management entry for how to prioritize an update like this one.
Timeline
- 24 Oct 2026
Nguyen Quang Tan reports the flaw through Patchstack's bug bounty program, per Patchstack's record.
- 30 Oct 2026
The CVE ID is reserved, per the CVE record.
- 6 Nov 2026
Patchstack publicly discloses the flaw on its vulnerability database page.
- 9 Nov 2026
The CVE record and the NVD entry are published.
What to do
-
Find Every Frontend Admin Install
List the WordPress sites you manage that run Frontend Admin by DynamiApps (acf-frontend-form-element) and note each installed version.
-
Update to 3.30.2 or Later
Patchstack's solution field names this update as the fix. Apply it on every site that has the plugin installed, active or not.
-
Review Who Can Reach Front-End Forms
We recommend checking which forms built with this plugin are reachable without login, since Patchstack lists the required privilege as unauthenticated.
-
Check the Administrator List After Patching
We recommend reviewing WordPress administrator accounts for any you do not recognize if you cannot confirm exactly when you updated.
-
Run a WordPress Exposure Check
Our free WordPress exposure check flags outdated plugins and themes across a domain.
Frequently Asked Questions
Which Frontend Admin by DynamiApps versions does CVE-2026-119506 affect?
The CVE record and Patchstack's page list the plugin as affected through 3.30.1. Patchstack names 3.30.2 as the patched release.
Does an attacker need a user account on the site?
Patchstack's record lists the required privilege as unauthenticated, so the attacker does not need an existing account.
Is there a workaround besides updating?
Patchstack's solution field names only the plugin update. No interim setting is listed in the record we opened.
Is CVE-2026-119506 in the CISA KEV catalog?
It is not, as of catalog version 2026.11.06, the version we checked on 9 November 2026.
Who found the flaw?
Patchstack credits Nguyen Quang Tan through its bug bounty program, with the report dated 24 October 2026.
