Frontend Admin by DynamiApps CVE-2026-10039

Authentication is required: the CVSS vector PR:H confirms the attacker must hold administrator-level (or higher) WordPress credentials before exploitation is possible - unauthenticated or subscriber/editor-level users cannot reach the vulnerable code path. Beyond authentication, the attacker must supply a valid 'orderby' parameter in the same request as the malicious 'order' value; without a recognized 'orderby' value, the code path that concatenates 'order' into the SQL query is never reached. The vulnerable endpoint is specifically the payments list admin page (main/admin/admin-pages/payments/list.php), meaning the plugin's payments functionality must be in active use on the site. Exploitation is limited to data extraction only (no write or delete capability per C:H/I:N/A:N) and is scoped to the current database (S:U). The primary limiting factor is the administrator privilege requirement, which restricts realistic attackers to: compromised admin accounts, malicious insiders, or scenarios where an attacker has already achieved admin-level access through a separate vulnerability.

The CVSS 3.1 score of 4.9 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) reflects a well-calibrated risk picture: while attack complexity is low and no user interaction is needed, the privilege requirement is High (PR:H - administrator-level), which sharply limits the realistic threat. An attacker must already hold full administrative credentials on the WordPress instance, meaning this vulnerability is most relevant in multi-tenant environments, SaaS WordPress hosts, or supply-chain compromise scenarios where a malicious administrator exists. The scope is Unchanged and impact is Confidentiality-only (C:H/I:N/A:N), meaning the attacker can read but not modify or destroy data. EPSS data was not provided in the input; given the PR:H requirement and niche plugin, real-world exploitation probability is expected to be low. KEV status is negative and no POC is mentioned, confirming no public exploit identified at time of analysis. The additional precondition - requiring a simultaneously valid 'orderby' parameter - further reduces automated exploitation potential. This is a genuine but low-urgency vulnerability: high CVSS confidentiality impact is real, but the admin-only attack surface makes it a lower operational priority than unauthenticated or subscriber-level SQLi.

An attacker with administrator credentials on the target WordPress site navigates to or sends a crafted HTTP request to the payments list admin endpoint, supplying a legitimate 'orderby' value alongside a malicious 'order' value containing appended SQL (e.g., appending a UNION SELECT to exfiltrate wp_users credentials or secret keys from wp_options). The gate condition - requiring a valid 'orderby' - is easily satisfied by inspecting normal plugin UI requests, and no special configuration beyond having the plugin active and the payments feature in use is required. No public exploit code has been identified at time of analysis, but the technique is well-understood and trivially reproducible by any attacker already holding admin access.