CVE-2026-6226
Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-6226 is a high-severity Improper Privilege Management (CWE-269) vulnerability in Wordpress (inferred from references). Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 33% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-2 (Account Management) and AC-24 (Access Control Decisions) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-32749
Vulnerability Data
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to unauthenticated privilege escalation in versions up to and including 3.29.2. This is due to insecure form submission handling that accepts arbitrary form definitions from user input instead of securely…
more
loading them from the backend. When $_POST['_acf_form'] is an array (rather than a form ID), the validate_form() function bypasses database lookup and directly processes the attacker-controlled structure. The create_record() function preserves attacker-supplied record data if present, and the user action's run() function falls back to attacker-controlled field definitions from $form['fields'] when legitimate fields cannot be found. The role field's pre_update_value() validation reads $field['role_options'] from this attacker-controlled definition, allowing an attacker to specify ['administrator'] as an allowed role and bypass the security check. This makes it possible for unauthenticated attackers to create administrator accounts by injecting a custom form configuration with a spoofed role field.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Account management directly governs assignment and tracking of privileges so proper implementation stops the weakness from being introduced.
Requiring explicit access-control decisions ensures privileges are evaluated rather than assumed or omitted.
Access enforcement applies the correct privilege checks at every request, structurally preventing unintended spheres of control.
Separation of duties constrains how privileges may be assigned, reducing the chance of overly broad actor control.
Least privilege is the direct countermeasure to improper privilege management; implementing it eliminates the root cause.
Binding security attributes to subjects/objects supplies the mechanism needed to track and enforce privileges correctly.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
A.5.15 directly mandates determining access requirements, defining/enforcing topic-specific access control policy, assigning rights/restrictions by entity/role, consistency with classification, need-to-know, privileged access restrictions, segregation, formal authorization, and dynamic rules — which stops most improper privilege management from being exploitable; bounded remainder is flawed implementation of those rules (e.g. incorrect mapping or enforcement bugs).
A.5.18 directly governs the provisioning, review, modification and timely revocation of access rights (including for role changes, termination and privilege levels), which stops most improper privilege spheres from being exploitable even if the assignment flaw exists; the bounded remainder is flaws in the underlying enforcement mechanism itself (e.g. AC-3/A.8.3)
A.8.2 directly controls the identification, allocation, review, expiry, temporary use, and separation of privileged rights per policy, which prevents most improper privilege management (CWE-269) by design; the bounded remainder is flawed tracking/checking logic inside the product's own enforcement code (the AC-3 slice of 269).
A.8.3 directly restricts access per policies (config mechanisms, per-user/group rights, isolation, dynamic techniques, auth/credential enforcement), which stops exploitation of most improper privilege management cases even if the assignment/tracking flaw remains; named remainder exists for non-access-control privilege errors (e.g. pure assignment bugs outside enforcement).
Hardening callouts derived
DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.