ACF Frontend Admin by DynamiApps · Security record

Is ACF Frontend Admin by DynamiApps safe?

2 known vulnerabilities affect the current version (3.30.2), and they have no fix yet.

Checked 5 days ago against the WPVulnerability database, for version 3.30.2.

How it’s looked after

Last release: Nov 1, 2026 (1 week ago)
Releases in the last year: 25
Tested up to: WordPress 7.1.4
Support resolved: 1 of 4 threads in two months
Active installs: 8K+

38 known vulnerabilities

9 critical
13 high
7 medium
9 not rated

2 affect the current version. 2 have no fix yet.

Disclosed each year

20223
20232
20244
20254
202625

Every known vulnerability in ACF Frontend Admin by DynamiApps

Newest first, with any that affect the current version at the top.

high
Missing Authorization
Affects the current version · No fix yet · CVE-2026-66470 · Aug 5, 2026 · Wordfence
critical
Unauthenticated Privilege Escalation
Affects the current version · No fix yet · CVE-2026-66662 · Aug 5, 2026 · Wordfence
Missing Authorization
Fixed in 3.30.0 · CVE-2026-81343 · Oct 15, 2026 · Wordfence
Authenticated (Administrator+) PHP Object Injection
Fixed in 3.30.0 · CVE-2026-81344 · Oct 15, 2026 · Wordfence
critical
Privilege Escalation vulnerability
Fixed in 3.30.0 · CVE-2026-109892 · Oct 15, 2026 · CVE
high
Authenticated (Administrator+) SQL Injection
Fixed in 3.30.0 · CVE-2026-42722 · Oct 9, 2026 · Wordfence
medium
Authenticated (Contributor+) Stored Cross-Site Scripting via Post Content
Fixed in 3.29.1 · CVE-2026-6243 · Oct 7, 2026 · Wordfence
External Control of File Name or Path
Fixed in 3.29.13 · CVE-2026-81347 · Sep 4, 2026 · CVE
critical
Unauthenticated Account Takeover via '_acf_objects' Object Identifier
Fixed in 3.29.13 · CVE-2026-75816 · Aug 31, 2026 · Wordfence
medium
Authenticated (Contributor+) Stored Cross-Site Scripting via 'tag' Shortcode Attribute
Fixed in 3.29.12 · CVE-2026-12747 · Aug 31, 2026 · Wordfence
high
Unauthenticated Arbitrary File Deletion via Path Traversal via custom_directory_name Merge Tag
Fixed in 3.29.13 · CVE-2026-19952 · Aug 31, 2026 · Wordfence
Authenticated (Subscriber+) Membership Plan Deletion
Fixed in 3.29.11 · CVE-2026-81346 · Aug 29, 2026 · Wordfence
medium
Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in 3.29.11 · CVE-2026-66638 · Aug 18, 2026 · Wordfence
critical
Unauthenticated Privilege Escalation via 'item_id' Parameter
Fixed in 3.29.10 · CVE-2026-18432 · Aug 11, 2026 · Wordfence
Missing Authorization
Fixed in 3.29.7 · CVE-2026-11867 · Jul 30, 2026 · Wordfence
Unauthenticated Stored Cross-Site Scripting
Fixed in 3.29.9 · CVE-2026-13609 · Jul 16, 2026 · Wordfence
high
Authenticated (Subscriber+) Arbitrary Password Reset via Encrypted Object Token
Fixed in 3.29.10 · CVE-2026-15606 · May 28, 2026 · Wordfence
medium
Authenticated (Administrator+) SQL Injection via 'order' Parameter
Fixed in 3.28.29 · CVE-2026-10039 · May 28, 2026 · Wordfence
high
Unauthenticated Privilege Escalation via Form Configuration Injection
Fixed in 3.29.3 · CVE-2026-6226 · May 27, 2026 · Wordfence
high
Missing Authorization to Authenticated (Subscriber+) Account Takeover via 'user_id' URL Query Parameter
Fixed in 3.29.3 · CVE-2026-7802 · May 27, 2026 · Wordfence
high
Unauthenticated Privilege Escalation via Edit User Form
Fixed in 3.29.1 · CVE-2026-6228 · May 14, 2026 · Wordfence
Authenticated (Editor+) PHP Object Injection via 'post_content' of Admin Form Posts
Fixed in 3.28.32 · CVE-2026-3328 · Mar 25, 2026 · Wordfence
critical
Unauthenticated Privilege Escalation to Administrator via Role Form Field
Fixed in 3.28.30 · CVE-2025-14736 · Jan 8, 2026 · Wordfence
critical
Missing Authorization to Unauthenticated Arbitrary Data Deletion via 'delete post' Form Element
Fixed in 3.28.26 · CVE-2025-14741 · Jan 8, 2026 · Wordfence
high
Unauthenticated Stored Cross-Site Scripting via 'update_field'
Fixed in 3.28.24 · CVE-2025-14937 · Jan 8, 2026 · Wordfence
critical
Unauthenticated Arbitrary Options Update
Fixed in 3.28.21 · CVE-2025-13342 · Dec 3, 2025 · Wordfence
high
Authenticated (Subscriber+) SQL Injection
Fixed in 3.28.5 · CVE-2025-49267 · Aug 12, 2025 · Wordfence
medium
Authenticated (Editor+) Arbitrary File Deletion
Fixed in 3.28.8 · CVE-2025-49303 · Jun 26, 2025 · Wordfence
high
Reflected Cross-Site Scripting
Fixed in 3.25.18 · CVE-2025-26987 · Feb 23, 2025 · Wordfence
medium
Unauthenticated SQL Injection
Fixed in 3.25.2 · CVE-2024-11722 · Dec 20, 2024 · Wordfence
high
Unauthenticated Privilege Escalation
Fixed in 3.25.1 · CVE-2024-11721 · Dec 13, 2024 · Wordfence
high
Unauthenticated Stored Cross-Site Scripting
Fixed in 3.25.1 · CVE-2024-11720 · Dec 13, 2024 · Wordfence
critical
Improper Missing Encryption Exception Handling to Form Manipulation
Fixed in 3.19.5 · CVE-2024-3729 · Apr 18, 2024 · Wordfence
critical
Unauthenticated Arbitrary File Upload
Fixed in 3.18.4 · CVE-2023-51411 · Dec 27, 2023 · Wordfence
high
Reflected Cross-Site Scripting
Fixed in 3.8.0 · CVE-2023-33999 · Jul 18, 2023 · WPScan
medium
Missing Authorization Checks
Fixed in 3.3.33 · CVE-2022-4974 · Mar 4, 2022 · Wordfence
Sensitive Information Disclosure vulnerability
Fixed in 3.3.33 · Feb 28, 2022 · Patchstack
Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability
Fixed in 3.3.33 · Feb 28, 2022 · Patchstack

Questions about ACF Frontend Admin by DynamiApps’s security

Is ACF Frontend Admin by DynamiApps safe to use?

Yes: 2 known vulnerabilities affect version 3.30.2, according to WPVulnerability’s database. Until a fixed version is out, weigh the risk, or switch to an alternative.

Does ACF Frontend Admin by DynamiApps have known security vulnerabilities?

Yes: 2 known vulnerabilities affect version 3.30.2, according to WPVulnerability’s database.

Is ACF Frontend Admin by DynamiApps still maintained?

Yes. Its last release was 1 week ago. Its authors resolved 1 of the 4 support threads opened in the last two months.

Is ACF Frontend Admin by DynamiApps compatible with the latest WordPress?

Yes. It’s tested up to WordPress 7.1.4, the current version.

Hear about the next one first

Track your plugin on TrackWP and get an alert when a new vulnerability affecting it is published. Every plan has it, the free Starter too; Boost and FullCharge email it at once.

Start free

Vulnerability data from WPVulnerability (CC0), which gathers records from CVE, Wordfence, Patchstack and WPScan. A clean record isn’t a guarantee: keep every plugin updated.