CVE-2026-11867: WordPress Frontend Admin Privilege Escalation

CVE-2026-11867 Overview

CVE-2026-11867 affects the Frontend Admin by DynamiApps WordPress plugin in versions prior to 3.29.7. The plugin fails to enforce capability checks on taxonomy term creation, modification, and deletion operations. Authenticated users with low privilege roles, including Subscribers, can create, rename, and delete arbitrary taxonomy terms on affected WordPress sites. The flaw is a broken access control issue [CWE-862] that undermines the WordPress role and capability model. Site administrators lose control over site taxonomy structures such as categories and tags, which can disrupt content organization and enable content-based attacks against visitors and editors.

Critical Impact
Any authenticated low-privilege user, including Subscribers, can create, rename, and delete arbitrary taxonomy terms on vulnerable sites.

Affected Products

Frontend Admin by DynamiApps WordPress plugin versions prior to 3.29.7
WordPress sites permitting Subscriber-level registration with the plugin installed
Multisite WordPress installations running the affected plugin

Discovery Timeline

2026-07-30 - CVE-2026-11867 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-11867

Vulnerability Analysis

The Frontend Admin by DynamiApps plugin exposes taxonomy management functionality through frontend-accessible endpoints. These endpoints handle term creation, editing, and deletion for any registered WordPress taxonomy, including built-in categories and tags as well as custom taxonomies registered by themes or other plugins. The plugin does not verify that the authenticated user holds the required WordPress capabilities such as manage_categories or edit_terms before executing these actions. As a result, the code path treats any authenticated request as authorized regardless of the user role. Refer to the WPScan Vulnerability Report for technical details.

Root Cause

The root cause is a missing authorization check [CWE-862] in the taxonomy term handlers. WordPress provides current_user_can() for capability enforcement, but the affected handlers omit this check before invoking wp_insert_term(), wp_update_term(), and wp_delete_term(). Authentication alone is treated as sufficient authorization, which contradicts the WordPress capability model.

Attack Vector

An attacker registers a Subscriber account on any WordPress site that permits open registration and runs the vulnerable plugin. The attacker then sends crafted requests to the plugin's frontend AJAX or REST endpoints responsible for taxonomy operations. The requests carry a valid nonce and authenticated session but no elevated capability. The server executes the taxonomy operation and returns success. Attackers can mass-create spam terms, rename existing categories to malicious labels containing script payloads for downstream stored cross-site scripting, or delete production taxonomy terms to disrupt site navigation and SEO.

Detection Methods for CVE-2026-11867

Indicators of Compromise

Unexpected taxonomy terms appearing in the wp_terms database table with recent term_id values
Modifications to existing category or tag names outside scheduled editorial workflows
Missing taxonomy terms that previously organized published content
WordPress activity log entries showing term operations attributed to Subscriber-level accounts

Detection Strategies

Audit the wp_terms and wp_term_taxonomy tables for terms created or modified by non-privileged accounts
Enable WordPress action logging plugins to capture created_term, edited_term, and delete_term hook events with user context
Correlate web server access logs for POST requests to Frontend Admin plugin endpoints originating from Subscriber sessions
Alert on bulk taxonomy term operations occurring in short time windows

Monitoring Recommendations

Ingest WordPress audit logs and web server logs into a centralized SIEM for correlation across sites
Monitor account registration spikes on sites that allow open user signup and run the vulnerable plugin
Track outbound links and rendered content for injected payloads placed via renamed taxonomy terms

How to Mitigate CVE-2026-11867

Immediate Actions Required

Update the Frontend Admin by DynamiApps plugin to version 3.29.7 or later on all WordPress sites
Review existing user accounts and remove untrusted Subscriber-level accounts created during the exposure window
Restore taxonomy terms from a known-good backup if unauthorized modifications are identified
Disable open user registration until patching is confirmed complete

Patch Information

The vendor released Frontend Admin by DynamiApps version 3.29.7, which adds capability checks to the taxonomy term handlers. Site operators should upgrade through the WordPress plugin dashboard or by replacing plugin files directly. Verify the installed version reports 3.29.7 or higher after upgrade. Consult the WPScan Vulnerability Report for advisory tracking.

Workarounds

Deactivate the Frontend Admin by DynamiApps plugin until the update is applied
Set users_can_register to false in WordPress general settings to block anonymous account creation
Restrict access to the plugin's frontend endpoints via web application firewall rules that require elevated roles

bash

# Verify installed plugin version via WP-CLI
wp plugin get acf-frontend-form-element --field=version

# Force update to the patched release
wp plugin update acf-frontend-form-element --version=3.29.7

# Disable open registration as a temporary hardening step
wp option update users_can_register 0