What is the CVSS score of CVE-2026-10039?

CVE-2026-10039 has a CVSS 3.1 base score of 4.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Frontend Admin by DynamiApps CVE-2026-10039

EUVD-2026-33259 MEDIUM

SQL Injection (CWE-89)

2026-05-29 Wordfence

GHSA-rjhf-4jpc-6xx6

SQLi WordPress

4.9

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.9 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 09:16 vuln.today

CVE Published

May 29, 2026 - 07:46 nvd

MEDIUM 4.9

DescriptionCVE.org

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to generic SQL Injection via the 'order' parameter in all versions up to, and including, 3.28.28 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires that the attacker also supply a valid 'orderby' parameter in the same request, as this is necessary to reach the vulnerable code path that processes and concatenates the 'order' value into the SQL query.

AnalysisAI

SQL Injection in the Frontend Admin by DynamiApps WordPress plugin (all versions through 3.28.28) allows authenticated administrators to extract arbitrary data from the WordPress database via the 'order' parameter in the payments list view. The vulnerability stems from unsanitized concatenation of user-supplied input into a raw SQL query, reachable only when a valid 'orderby' parameter is also present in the same request. No public exploit has been identified at time of analysis, and the high privilege requirement (administrator-level) substantially limits the realistic attacker pool, keeping this a medium-severity, low-urgency finding despite the AV:N classification.

Technical ContextAI

The affected plugin, identified by CPE cpe:2.3:a:shabti:frontend_admin_by_dynamiapps:*:*:*:*:*:*:*:* and distributed under the WordPress slug acf-frontend-form-element, processes a payments list in its admin back-end. The vulnerable code resides in main/admin/admin-pages/payments/list.php (lines 45-46 per plugin trac references), where the 'order' parameter value is insufficiently escaped and directly concatenated into an existing SQL query without proper prepared-statement handling. CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) is the root cause: the query construction trusts caller-controlled sort direction without parameterization. The 'orderby' parameter acts as a gate - it must be supplied and valid to reach the branch that concatenates 'order', meaning exploitation is path-dependent rather than universally triggerable on every request.

RemediationAI

Vendor-released patch: 3.29.3. Site administrators should update the Frontend Admin by DynamiApps plugin to version 3.29.3 or later via the WordPress admin dashboard (Plugins → Updates) or by downloading directly from the WordPress plugin repository. The fix modifies lines 45-46 of main/admin/admin-pages/payments/list.php to properly escape or parameterize the 'order' value before SQL concatenation, as visible in the trac changeset referenced at https://plugins.trac.wordpress.org/changeset?reponame=&old=3472098%40acf-frontend-form-element&new=3472098%40acf-frontend-form-element. If immediate patching is not possible, a compensating control is to audit and restrict which accounts hold WordPress administrator roles, as the vulnerability is unreachable without administrator-level authentication - reducing admin account sprawl directly limits exploitability without requiring application changes. Web application firewall rules targeting SQL metacharacter injection in the 'order' parameter (e.g., blocking values containing UNION, SELECT, or SQL comment sequences) can provide an additional layer, though these carry a risk of false positives on legitimate sort requests.