A critical flaw in a widely used WordPress plugin lets an ordinary logged-in user gain administrator rights over a site. The flaw, tracked as CVE-2026-119506, was published in the CVE database on 9 November 2026 and carries a CVSS score of 9.1 out of 10, in the critical range.

The flaw affects Frontend Admin by DynamiApps, a plugin for building front-end forms for posting and editing content. Every version through 3.30.1 is affected; the fix is 3.30.2. It is an incorrect privilege assignment, classified as CWE-266, meaning the plugin can hand a user higher privileges than intended.

Attack needs no special access

The CVSS vector for the flaw is stark: it is reachable over the network, rated low complexity, and needs neither existing privileges nor any interaction from a victim. In practice, a low-privilege account could escalate itself to full administrator, with control over settings, content and other users.

Patchstack, the database that acts as CNA for this CVE, lists it as a privilege escalation in the plugin, also known by its slug acf-frontend-form-element. There is no sign of exploitation yet: it is not in CISA's Known Exploited Vulnerabilities catalogue, no public exploit code has been indexed, and threat sensors have recorded no attack traffic.

Update now, then check user roles

That should not breed complacency: Patchstack warns that flaws of this kind are frequently targeted in mass-exploit campaigns probing thousands of WordPress sites at a time. Site owners should update to 3.30.2 immediately, then check their user list for administrator accounts they do not recognise.

The plugin has form here: Patchstack records earlier privilege-escalation flaws fixed in versions 3.25.1 and 3.28.26 in 2026. For sites that cannot update at once, Patchstack has issued a mitigation rule to block attacks until the patch is installed.