ACF Frontend Admin by DynamiApps

Most reviewers call it a genuinely useful free front-end editing tool that works well with ACF and custom post types, while a few paying users say support went unanswered for weeks and the release cadence is too frequent.

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory searches this plugin turns up in, and which way each one is moving. WordPress.org publishes no history of search positions, so this starts the day we first tracked a keyword and never backfills.

wp.org is where the directory puts the plugin for that search. On merit is where it would sit if results were ranked on rating, support and updates, without the install boost. The last column is how far the wp.org position moved, from our first reading in the last 90 days to the latest.

167 searches this plugin appeared in over the last 90 days, 20 listed. 126 left out as unrelated or noise (years, numbers, stray words). 2 of its tags aren't in the top 24 for their own search.

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Crossed into this band 49 days ago and a band this size takes about a year or more to cross, so the real count is still just under 9K.

1. ★★★★★ martinsch85

   1.2y ago

   The first week all perfect.

   Read on wp.org ↗
2. ★★★★★ ioannis067

   1.2y ago

   in elementor pro Frontend Admin Fiields widget in the Featured Image Field have 2 choiceLibrary All & Uploadet to postand missing the Uploaded by current userthat exists in the forms in the backendif you can transfer it to Elementor because I want to create forms with Elementor and this option is not available thank you

   Read on wp.org ↗
3. ★★★★★ webkomomai

   1.2y ago

   Frontend Admin est un outil très utile pour faciliter la modification de contenus à des auteurs par exemple. Il s’intègre parfaitement bien et contient de nombreux réglages. Merci pour le développement !

   Read on wp.org ↗
4. ★★★★★ hattyo

   1.3y ago

   really great plugin and its free too. This topic was modified 3 months, 3 weeks ago by hattyo.

   Read on wp.org ↗
5. ★★★★★ sashad2003

   1.3y ago

   Thank you Shabtay for good work and best support

   Read on wp.org ↗
6. ★★★★★ brigalo

   1.3y ago

   I would like to see a video on the bricks integration specifically looking at how cpt’s work and how the various forms can be styled. I’ve used css (thanks chat gpt) but is there a way to style the entry sections in bricks?

   Read on wp.org ↗
7. ★★★★★ nknov12

   1.3y ago

   A great effort in giving a FREE GUI for ACF Forms. Reduced 1 star for very frequent releases.

   Read on wp.org ↗
8. ★★★★★ 5trilly

   1.4y ago

   Great plugin

   Read on wp.org ↗

Recent releases and news for this plugin

1. — Version 3.29.9 Changed character limit color scheme to use percentage of the limit reached instead of a fixed character count Added option to always use default color for character limit message Fixed “Show Remaining Characters” settin 3.29.9
2. — Version 3.29.8 Added character count feature to all text fields 3.29.8
3. — Version 3.29.7 Added special permissions options Fixed Product Status field 3.29.7
4. — Version 3.29.6 Fixed permissions showing when user can view form 3.29.6
5. — Version 3.29.5 Fixed error when non admins submit forms in Gutenberg and Bricks 3.29.5
6. — Version 3.29.4 Fixed Multi Step forms 3.29.4

All 36 disclosed vulnerabilities are patched in the current version (3.30.1). Sites still on an older version should update.

1. Patched Medium · 5.3 Frontend Admin by DynamiApps <= 3.29.0 - Missing Authorization ↗
   2026-10-15 CVE-2026-81343 Missing Authorization Affects <= 3.29.0 Patched in 3.30.0
2. Patched Medium · 6.6 Frontend Admin by DynamiApps <= 3.29.0 - Authenticated (Administrator+) PHP Object Injection ↗
   2026-10-15 CVE-2026-81344 Deserialization of Untrusted Data Affects <= 3.29.0 Patched in 3.30.0
3. Patched High · 7.3 ACF Frontend Admin by DynamiApps <= 3.29.13 - Unauthenticated Privilege Escalation ↗
   2026-10-13 CVE-2026-109892 Improper Privilege Management Affects <= 3.29.13 Patched in 3.30.0
4. Patched Medium · 6.4 Frontend Admin by DynamiApps <= 3.28.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Content ↗
   2026-10-09 CVE-2026-6243 Improper Neutralization of Input During Web Page Generation Affects <= 3.28.36 Patched in 3.29.1
5. Patched Medium · 4.9 Frontend Admin by DynamiApps <= 3.29.13 - Authenticated (Administrator+) SQL Injection ↗
   2026-10-07 CVE-2026-42722 Improper Neutralization of Special Elements used in an SQL Command Affects <= 3.29.13 Patched in 3.30.0
6. Patched Critical · 9.8 Frontend Admin by DynamiApps <= 3.29.12 - Unauthenticated Account Takeover via '_acf_objects' Object Identifier ↗
   2026-09-05 CVE-2026-75816 Improper Authentication Affects <= 3.29.12 Patched in 3.29.13
7. Patched High · 8.2 Frontend Admin by DynamiApps <= 3.29.12 - Unauthenticated Path Traversal ↗
   2026-09-02 CVE-2026-81347 Improper Limitation of a Pathname to a Restricted Directory Affects <= 3.29.12 Patched in 3.29.13
8. Patched Medium · 6.4 Frontend Admin by DynamiApps <= 3.29.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tag' Shortcode Attribute ↗
   2026-08-31 CVE-2026-12747 Improper Neutralization of Input During Web Page Generation Affects <= 3.29.11 Patched in 3.29.12
9. Patched High · 7.5 Frontend Admin by DynamiApps <= 3.29.12 - Unauthenticated Arbitrary File Deletion via Path Traversal via custom_directory_name Merge Tag ↗
   2026-08-31 CVE-2026-19952 Improper Limitation of a Pathname to a Restricted Directory Affects <= 3.29.12 Patched in 3.29.13
10. Patched Medium · 4.3 Frontend Admin by DynamiApps < 3.29.11 - Authenticated (Subscriber+) Membership Plan Deletion ↗
    2026-08-27 CVE-2026-81346 Improper Limitation of a Pathname to a Restricted Directory Affects < 3.29.11 Patched in 3.29.11
11. Patched Medium · 6.4 Frontend Admin by DynamiApps <= 3.29.10 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
    2026-08-18 CVE-2026-66638 Improper Neutralization of Input During Web Page Generation Affects <= 3.29.10 Patched in 3.29.11
12. Patched Critical · 9.8 Frontend Admin by DynamiApps <= 3.29.9 - Unauthenticated Privilege Escalation via 'item_id' Parameter ↗
    2026-08-15 CVE-2026-18432 Improper Privilege Management Affects <= 3.29.9 Patched in 3.29.10
13. Patched High · 8.8 Frontend Admin by DynamiApps <= 3.29.9 - Authenticated (Subscriber+) Arbitrary Password Reset via Encrypted Object Token ↗
    2026-08-11 CVE-2026-15606 Missing Authorization Affects <= 3.29.9 Patched in 3.29.10
14. Patched Critical · 9.8 Frontend Admin by DynamiApps <= 3.29.12 - Unauthenticated Privilege Escalation ↗
    2026-08-05 CVE-2026-66662 Incorrect Privilege Assignment Affects <= 3.29.12 Patched in 3.29.13
15. Patched Medium · 4.3 Frontend Admin by DynamiApps < 3.29.7 - Missing Authorization ↗
    2026-08-05 CVE-2026-11867 Missing Authorization Affects < 3.29.7 Patched in 3.29.7
16. Patched Medium · 4.3 Frontend Admin by DynamiApps <= 3.29.10 - Missing Authorization ↗
    2026-08-05 CVE-2026-66470 Missing Authorization Affects <= 3.29.10 Patched in 3.29.11
17. Patched High · 7.2 Frontend Admin by DynamiApps <= 3.29.8 - Unauthenticated Stored Cross-Site Scripting ↗
    2026-07-16 CVE-2026-13609 Improper Neutralization of Input During Web Page Generation Affects <= 3.29.8 Patched in 3.29.9
18. Patched Medium · 4.9 Frontend Admin by DynamiApps <= 3.28.28 - Authenticated (Administrator+) SQL Injection via 'order' Parameter ↗
    2026-05-28 CVE-2026-10039 Improper Neutralization of Special Elements used in an SQL Command Affects <= 3.28.8 Patched in 3.28.29
19. Patched High · 8.8 Frontend Admin by DynamiApps <= 3.29.2 - Missing Authorization to Authenticated (Subscriber+) Account Takeover via 'user_id' URL Query Parameter ↗
    2026-05-27 CVE-2026-7802 Missing Authorization Affects <= 3.29.2 Patched in 3.29.3
20. Patched High · 8.8 Frontend Admin by DynamiApps <= 3.29.2 - Unauthenticated Privilege Escalation via Form Configuration Injection ↗
    2026-05-27 CVE-2026-6226 Improper Privilege Management Affects <= 3.29.2 Patched in 3.29.3
21. Patched High · 8.8 Frontend Admin by DynamiApps <= 3.28.36 - Unauthenticated Privilege Escalation via Edit User Form ↗
    2026-05-14 CVE-2026-6228 Improper Privilege Management Affects <= 3.28.36 Patched in 3.29.1
22. Patched High · 7.2 Frontend Admin by DynamiApps <= 3.28.31 - Authenticated (Editor+) PHP Object Injection via 'post_content' of Admin Form Posts ↗
    2026-03-25 CVE-2026-3328 Deserialization of Untrusted Data Affects <= 3.28.31 Patched in 3.28.32
23. Patched High · 7.2 Frontend Admin by DynamiApps <= 3.28.23 - Unauthenticated Stored Cross-Site Scripting via 'update_field' ↗
    2026-01-08 CVE-2025-14937 Improper Neutralization of Input During Web Page Generation Affects <= 3.28.23 Patched in 3.28.24
24. Patched Critical · 9.1 Frontend Admin by DynamiApps <= 3.28.25 - Missing Authorization to Unauthenticated Arbitrary Data Deletion via 'delete post' Form Element ↗
    2026-01-08 CVE-2025-14741 Missing Authorization Affects <= 3.28.25 Patched in 3.28.26
25. Patched Critical · 9.8 Frontend Admin by DynamiApps <= 3.28.29 - Unauthenticated Privilege Escalation to Administrator via Role Form Field ↗
    2026-01-08 CVE-2025-14736 Improper Privilege Management Affects <= 3.28.29 Patched in 3.28.30
26. Patched Critical · 9.8 Frontend Admin by DynamiApps <= 3.28.20 - Unauthenticated Arbitrary Options Update ↗
    2025-12-03 CVE-2025-13342 Missing Authorization Affects <= 3.28.20 Patched in 3.28.21
27. Patched Medium · 6.5 Frontend Admin by DynamiApps <= 3.28.3 - Authenticated (Subscriber+) SQL Injection ↗
    2025-08-12 CVE-2025-49267 Improper Neutralization of Special Elements used in an SQL Command Affects <= 3.28.3 Patched in 3.28.5
28. Patched Medium · 6.5 Frontend Admin by DynamiApps <= 3.28.7 - Authenticated (Editor+) Arbitrary File Deletion ↗
    2025-06-26 CVE-2025-49303 Improper Limitation of a Pathname to a Restricted Directory Affects <= 3.28.7 Patched in 3.28.8
29. Patched Medium · 6.1 Frontend Admin by DynamiApps <= 3.25.17 - Reflected Cross-Site Scripting ↗
    2025-02-23 CVE-2025-26987 Improper Neutralization of Input During Web Page Generation Affects <= 3.25.17 Patched in 3.25.18
30. Patched Medium · 5.9 Frontend Admin by DynamiApps <= 3.25.1 - Unauthenticated SQL Injection ↗
    2024-12-20 CVE-2024-11722 Improper Neutralization of Special Elements used in an SQL Command Affects <= 3.25.1 Patched in 3.25.2
31. Patched High · 7.2 Frontend Admin by DynamiApps <= 3.24.5 - Unauthenticated Stored Cross-Site Scripting ↗
    2024-12-13 CVE-2024-11720 Improper Neutralization of Input During Web Page Generation Affects <= 3.24.5 Patched in 3.25.1
32. Patched High · 8.1 Frontend Admin by DynamiApps <= 3.24.5 - Unauthenticated Privilege Escalation ↗
    2024-12-13 CVE-2024-11721 Improper Privilege Management Affects <= 3.24.5 Patched in 3.25.1
33. Patched Critical · 9.8 Frontend Admin by DynamiApps <= 3.19.4 - Improper Missing Encryption Exception Handling to Form Manipulation ↗
    2024-04-18 CVE-2024-3729 Not Failing Securely Affects <= 3.19.4 Patched in 3.19.5
34. Patched Critical · 9.8 Frontend Admin by DynamiApps Plugin <= 3.18.3 - Unauthenticated Arbitrary File Upload ↗
    2023-12-27 CVE-2023-51411 Unrestricted Upload of File with Dangerous Type Affects <= 3.18.3 Patched in 3.18.4
35. Patched Medium · 6.1 Freemius SDK <= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get ↗
    2023-07-18 CVE-2023-33999 Improper Neutralization of Input During Web Page Generation Affects <= 3.7.11 Patched in 3.8.0
36. Patched Medium · 6.3 Freemius SDK <= 2.4.2 - Missing Authorization Checks ↗
    2022-03-04 CVE-2022-4974 Missing Authorization Affects < 3.3.33 Patched in 3.3.33

Automated install-time checks, tested on PHP 8.1.12 · WP 7.0

Translated into 18 languages, 1 at 90% or more

Whether ChatGPT and Claude name this plugin when asked the category question, and whether the readme gives them something to quote.

Not measured yet for this plugin’s topics. Its tracked searches are not among the measured topics. See the topics measured so far.

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

1. 2026-09-12 9K+ → 8K+ down after 1 days in tier
2. 2026-09-11 8K+ → 9K+ up after 1 days in tier
3. 2026-09-10 9K+ → 8K+ down after 62 days in tier
4. 2026-07-10 10K+ → 9K+ down after 428 days in tier
5. 2025-05-08 9K+ → 10K+ up after 3 days in tier
6. 2025-05-05 10K+ → 9K+ down after 2 days in tier
7. 2025-05-03 9K+ → 10K+ up after 801 days in tier
8. 2023-02-22 8K+ → 9K+ up after 52 days in tier

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

Embed this report card

Drop a live Pulse card for ACF Frontend Admin by DynamiApps into a readme, a review or a deck. It updates itself.

ACF Frontend Admin by DynamiApps: 8K+ active installs, 4.5★ (160 reviews). Plugin Pulse (WP Mayor), as of 2026-10-31. https://plugins.wpmayor.com/plugin/acf-frontend-form-element