Frontend Admin by DynamiApps Security & Risk Analysis

The 'acf-frontend-form-element' plugin v3.28.30 exhibits a concerning security posture, primarily due to a large attack surface with a significant number of unprotected entry points. The 46 unprotected AJAX handlers represent a substantial risk, potentially allowing unauthenticated users to trigger plugin functionality. While the use of prepared statements for SQL queries and a high percentage of properly escaped output are positive indicators, the presence of the `unserialize` function is a notable weakness, as it can be a vector for code execution if used with untrusted input. The taint analysis reveals 7 high-severity flows with unsanitized paths, further highlighting potential risks that could lead to vulnerabilities like path traversal or information disclosure.

The plugin's vulnerability history is particularly alarming. With 12 known CVEs, including 5 critical and 3 high-severity issues, and a recent vulnerability recorded in early 2026, it suggests a pattern of recurring security flaws. The types of common vulnerabilities—Missing Authorization, Improper Privilege Management, Path Traversal, XSS, SQL Injection, Failing Open, and Unrestricted Uploads—indicate a consistent struggle with secure coding practices across various attack vectors. While there are currently no unpatched vulnerabilities, the sheer number and severity of past issues, coupled with the current code analysis findings, warrant significant caution.

In conclusion, while the plugin demonstrates some good practices like prepared SQL statements and output escaping, these are overshadowed by the extensive unprotected attack surface and a problematic vulnerability history. The presence of `unserialize` and high-severity taint flows are immediate concerns. The historical pattern of critical vulnerabilities suggests a need for thorough security audits and potentially a different plugin choice if these issues are not addressed diligently. The plugin's strengths in SQL handling are outweighed by its weaknesses in access control and historical security reliability.