Organisations at Risk: CVSS 9.8 CVE-2026-109892 in Frontend Admin 3.29.13 Allows Privilege Escalation
A critical vulnerability in the Frontend Admin plugin allows privilege escalation, affecting all versions up to 3.29.13.
Key points
- The flaw is rated CVSS 9.8 Critical and involves incorrect privilege assignment.
- All versions of the plugin up to and including 3.29.13 are vulnerable.
- The vulnerability is tracked as CVE-2026-109892.
The Frontend Admin plugin by DynamiApps contains a critical security flaw that permits privilege escalation. According to the National Vulnerability Database record for CVE-2026-109892, the issue stems from incorrect privilege assignment within the acf-frontend-form-element component. This vulnerability affects every version of the plugin released up to 3.29.13. The National Vulnerability Database describes the weakness as CWE-266.
How it unfolded
- The National Vulnerability Database published the record for CVE-2026-109892, identifying the flaw.
- The entry classified the vulnerability as Critical with a CVSS score of 9.8.
- The record specified that the weakness is CWE-266, Incorrect Privilege Assignment.
Who is affected
Organizations using the Shabti Kaplan Frontend Admin plugin by DynamiApps are at risk. The vulnerability impacts all versions of the software from its initial release through version 3.29.13. The flaw allows for privilege escalation, as described in the NVD record. This mirrors the urgency seen in recent plugin vulnerabilities, such as the Fluent CRM risk Patch Observer reported on October 15, 2026.
Our take on the response
The National Vulnerability Database rates this flaw as Critical. With a CVSS score of 9.8, the potential for exploitation is severe. That suggests organizations should prioritize containment strategies while awaiting further information. The high severity rating indicates that the flaw involves incorrect privilege assignment.
Who needs to act first
Teams should identify all client sites running the vulnerable plugin versions immediately. Prioritize environments where the plugin is used on public-facing forms or pages accessible to unauthenticated users. Check whether temporary deactivation of the specific form elements is possible without breaking core site functionality. Ensure that current backups are verified and ready for restoration if compromise occurs. Coordinate with development teams to monitor for official vendor communications regarding a patch release.
What to do and how to stay safe: DynamiApps
- Audit all managed WordPress installations to locate any instances of the Frontend Admin plugin.
- Verify the installed version against the vulnerable range ending at 3.29.13.
- Restrict access to forms created by the plugin to authenticated administrators only.
- Monitor server logs for unusual privilege escalation attempts or unauthorized administrative actions.
Step-by-step guide: Vulnerability Prioritization: How to Rank Risks Without Wasting Time
General security guidance from the Patch Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of the DynamiApps Frontend Admin plugin are vulnerable?
All versions from the initial release up to and including version 3.29.13 are affected by this flaw.
Is there a patch available for CVE-2026-109892?
The source material does not state whether a fix or update has been released by the vendor.
What is the severity rating of this vulnerability?
The National Vulnerability Database rates the flaw as Critical with a CVSS score of 9.8.
