What is the CVSS score of CVE-2026-15606?

CVE-2026-15606 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Frontend Admin are affected by CVE-2026-15606?

The Frontend Admin by DynamiApps WordPress plugin (versions through 3.29.9) contains a critical authorization bypass in password reset functionality that allows any authenticated user to hijack…

How to fix or mitigate CVE-2026-15606?

Within 24 hours: identify all WordPress installations running Frontend Admin by DynamiApps, confirm the active version against 3.29.9, and disable password reset functionality at the application level if possible. Within 7 days: restrict Edit User permissions to administrator accounts only, implement multi-factor authentication for all admin users, and contact DynamiApps for patched release timeline. Within 30 days: upgrade to a patched version once released, or evaluate and migrate to alternative plugins if no patch becomes available; establish continuous monitoring of CVE trackers and vendor security advisories.

Frontend Admin CVE-2026-15606

EUVD-2026-56970 HIGH

Missing Authorization (CWE-862)

2026-08-11 Wordfence

GHSA-rhhg-4g4v-rqcf

WordPress Authentication Bypass Frontend Admin By Dynamiapps Wordpress Plugin Shabti

8.8

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

PR:L reflects mandatory subscriber-level authentication; AC:L is warranted as CBC bit-flipping is systematic once a valid token is obtained; full C/I/A from admin account takeover.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 21:40 vuln.today

CVE Published

Aug 11, 2026 - 20:26 nvd

HIGH 8.8

DescriptionCVE.org

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.29.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level and above permissions, to reset the password of any user on the site, including administrators, leading to full account takeover and complete site compromise. Exploitation requires the attacker to hold a valid encrypted Current-User token obtained by accessing any Edit User form they are legitimately authorized to submit, which they then use as a known-plaintext base for the CBC bit-flipping forgery.

Articles & Coverage 1

News 6 New WordPress Vulnerabilities - 1 Critical, 5 High Severity Aug 12, 2026

AnalysisAI

Password reset authorization bypass in the Frontend Admin by DynamiApps WordPress plugin (all versions through 3.29.9) allows any authenticated subscriber to overwrite the credentials of any account on the site, including administrators, leading to full account takeover and complete site compromise. The plugin improperly validates authorization during password reset operations and protects user identity with a CBC-mode encrypted token; an attacker who legitimately obtains that token through an authorized Edit User form submission can apply standard CBC bit-flipping techniques to forge a token resolving to any other user identity, including site admins, without possessing the encryption key. No public exploit code has been identified at time of analysis, and active exploitation has not been confirmed by CISA KEV, though the low technical barrier and well-documented nature of CBC bit-flipping make this high-urgency for affected deployments.

Technical ContextAI

The vulnerability resides in the authorization layer of the Frontend Admin by DynamiApps WordPress plugin (plugin slug: acf-frontend-form-element, CPE: cpe:2.3:a:shabti:frontend_admin_by_dynamiapps:*:*:*:*:*:*:*:*), specifically in the password reset flow spanning helpers.php (L687), submit.php (L36 and L54), and class-user-password.php (L146) as referenced in WordPress Trac at plugin tag 3.29.5. CWE-862 (Missing Authorization) identifies the root cause class: the plugin processes password reset requests without verifying the requesting user is authorized to reset the target account's password. The user identity for form operations is carried in an encrypted Current-User token generated using CBC (Cipher Block Chaining) mode. CBC is a symmetric cipher mode vulnerable to bit-flipping attacks when an adversary possesses a known plaintext block - because flipping a bit in ciphertext block N causes a predictable, controlled bit-flip in the corresponding position of plaintext block N+1. A subscriber who legitimately submits any Edit User form they are authorized to access receives such a token. With knowledge of the expected plaintext structure, they can craft a modified ciphertext that decrypts to a different user identity (e.g., an administrator's user ID) without the encryption key, and the server acts on the forged identity without re-verifying authorization.

RemediationAI

A code-level fix has been committed to the WordPress plugin repository via changeset 3633030 (https://plugins.trac.wordpress.org/changeset/3633030/acf-frontend-form-element); however, the exact released version number incorporating this fix is not explicitly confirmed in the available intelligence data. Site owners should update the plugin to the latest available version from the WordPress Plugin Directory and verify that the installed version is later than 3.29.9. As a compensating control prior to patching, administrators can disable open subscriber registration under Settings > General by unchecking 'Anyone can register,' which eliminates the most accessible path to obtaining a subscriber account - note this also prevents legitimate new user self-registration. Additionally, restricting all frontend Edit User forms to trusted roles only via the plugin's built-in role-gating settings prevents unelevated accounts from obtaining the encrypted token needed as the known-plaintext for bit-flipping. Complete deactivation and removal of the plugin is recommended for any WordPress deployment that does not actively use its frontend user-editing functionality until a confirmed patched release is installed.