CVE-2026-6228

🗓️ 15 May 2026 07:46:36Reported by WordfenceType

cve🔗 web.nvd.nist.gov👁 13 Views🌐 WEB

Unauthenticated privilege escalation in Frontend Admin by DynamiApps <=3.28.36 via edit_user form.

Reporter	Title	Published	Views	Family All 9
ATTACKERKB	CVE-2026-6228	15 May 202607:46	–	attackerkb
CNNVD	WordPress plugin Frontend Admin by DynamiApps 安全漏洞	15 May 202600:00	–	cnnvd
Cvelist	CVE-2026-6228 Frontend Admin by DynamiApps <= 3.28.36 - Unauthenticated Privilege Escalation via Edit User Form	15 May 202607:46	–	cvelist
EUVD	EUVD-2026-30513	15 May 202607:46	–	euvd
NVD	CVE-2026-6228	15 May 202609:16	–	nvd
Patchstack	WordPress Frontend Admin by DynamiApps plugin <= 3.28.36 - Unauthenticated Privilege Escalation vulnerability	15 May 202610:31	–	patchstack
Positive Technologies	PT-2026-41274	15 May 202600:00	–	ptsecurity
RedhatCVE	CVE-2026-6228	5 Jun 202619:17	–	redhatcve
Vulnrichment	CVE-2026-6228 Frontend Admin by DynamiApps <= 3.28.36 - Unauthenticated Privilege Escalation via Edit User Form	15 May 202607:46	–	vulnrichment

Vulners

Node

shabti frontend_admin_by_dynamiappsRange≤3.28.36wordpress

[
  {
    "vendor": "shabti",
    "product": "Frontend Admin by DynamiApps",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "3.28.36",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/browser/acf-frontend-form-element/trunk/main/frontend/fields/user/class-role.php
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/083accd0-8338-47c6-b396-96679b95dd40
plugins	www.plugins.trac.wordpress.org/browser/acf-frontend-form-element/trunk/main/admin/admin-pages/forms/post-types.php
plugins	www.plugins.trac.wordpress.org/changeset/3519460
plugins	www.plugins.trac.wordpress.org/browser/acf-frontend-form-element/trunk/main/frontend/forms/actions/user.php

Parameter	Position	Path	Description	CWE
role	request body	wp-admin/post.php	Privilege escalation through insufficient authorization checks when submitting an edit_user form via wp-admin/post.php; an attacker can manipulate submitted form data to include administrator in role_options and gain administrator privileges.	CWE-269
role_options	request body	wp-admin/post.php	Privilege escalation through insufficient authorization checks when submitting an edit_user form via wp-admin/post.php; an attacker can manipulate submitted form data to include administrator in role_options and gain administrator privileges.	CWE-269

15 May 2026 14:09Current

5.7Medium risk

Vulners AI Score5.7

CVSS 3.18.8

EPSS0.00126

SSVC

CWE-269