EUVD-2026-56970
GHSA-rhhg-4g4v-rqcf
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
PR:L reflects mandatory subscriber-level authentication; AC:L is warranted as CBC bit-flipping is systematic once a valid token is obtained; full C/I/A from admin account takeover.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.29.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level and above permissions, to reset the password of any user on the site, including administrators, leading to full account takeover and complete site compromise. Exploitation requires the attacker to hold a valid encrypted Current-User token obtained by accessing any Edit User form they are legitimately authorized to submit, which they then use as a known-plaintext base for the CBC bit-flipping forgery.
Articles & Coverage 1
AnalysisAI
Password reset authorization bypass in the Frontend Admin by DynamiApps WordPress plugin (all versions through 3.29.9) allows any authenticated subscriber to overwrite the credentials of any account on the site, including administrators, leading to full account takeover and complete site compromise. The plugin improperly validates authorization during password reset operations and protects user identity with a CBC-mode encrypted token; an attacker who legitimately obtains that token through an authorized Edit User form submission can apply standard CBC bit-flipping techniques to forge a token resolving to any other user identity, including site admins, without possessing the encryption key. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to hold a valid authenticated WordPress session at subscriber level or above - open user registration is the most common path, though compromised or socially-engineered subscriber credentials would also suffice. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS rates this 8.8 (High) with AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, accurately reflecting that any low-privilege authenticated user can achieve administrative account takeover over the network with no user interaction required. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker registers a free subscriber account on a target WordPress site running Frontend Admin by DynamiApps version 3.29.9 or earlier and navigates to any Edit User form they are legitimately permitted to submit, capturing the encrypted Current-User token the plugin issues. Applying known-plaintext CBC bit-flipping, they modify specific bytes of the ciphertext so that it decrypts to the WordPress administrator's user ID, then submit a password reset request using the forged token, resetting the admin password and gaining full administrative control of the site. |
| Remediation | A code-level fix has been committed to the WordPress plugin repository via changeset 3633030 (https://plugins.trac.wordpress.org/changeset/3633030/acf-frontend-form-element); however, the exact released version number incorporating this fix is not explicitly confirmed in the available intelligence data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: identify all WordPress installations running Frontend Admin by DynamiApps, confirm the active version against 3.29.9, and disable password reset functionality at the application level if possible. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Frontend Admin By Dynamiapps
View allStored cross-site scripting in the Frontend Admin by DynamiApps WordPress plugin (all versions before 3.29.9) allows una
Missing authorization in Frontend Admin by DynamiApps WordPress plugin (versions before 3.29.7) exposes taxonomy term cr
Privilege escalation in the Frontend Admin by DynamiApps WordPress plugin (all versions through 3.29.9) lets attackers t
Privilege escalation in the Frontend Admin by DynamiApps WordPress plugin (versions up to and including 3.29.10) lets re
Broken access control in Frontend Admin by DynamiApps (WordPress plugin, versions ≤ 3.29.10) allows subscriber-level aut
Stored Cross-Site Scripting in the Frontend Admin by DynamiApps WordPress plugin (versions up to and including 3.29.10)
SQL Injection in the Frontend Admin by DynamiApps WordPress plugin (all versions through 3.28.28) allows authenticated a
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today