What is the CVSS score of CVE-2026-18432?

CVE-2026-18432 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Frontend Admin are affected by CVE-2026-18432?

The Frontend Admin plugin for WordPress (versions through 3.29.9) contains a critical privilege escalation vulnerability allowing attackers to seize the default administrator account and gain…

How to fix or mitigate CVE-2026-18432?

Within 24 hours: Deactivate and remove the Frontend Admin by DynamiApps plugin (all versions through 3.29.9) from all WordPress installations; if immediate removal is operationally infeasible, disable all publicly accessible frontend admin forms and restrict access via Web Application Firewall rules or IP whitelisting. Within 7 days: Conduct a comprehensive audit of administrative and subscriber account activity over the past 90 days, reviewing WordPress logs for password changes, email modifications, and unauthorized account alterations; force a password reset for all administrator and subscriber accounts; preserve security event logs for forensic analysis. Within 30 days: Identify and deploy an alternative plugin with equivalent functionality that maintains current security advisories; establish a process to regularly monitor vulnerability disclosures affecting active WordPress plugins.

Frontend Admin CVE-2026-18432

EUVD-2026-59849 CRITICAL

Improper Privilege Management (CWE-269)

2026-08-16 Wordfence

GHSA-ch22-9ppp-5952

WordPress Privilege Escalation Frontend Admin By Dynamiapps Wordpress Plugin Shabti

9.8

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Remote, single-parameter trigger with no auth when a public frontend user form exists (PR:N/AC:L), yielding full admin takeover, so C:I:A all High.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 16, 2026 - 05:01 vuln.today

CVE Published

Aug 16, 2026 - 04:24 cve.org

CRITICAL 9.8

DescriptionCVE.org

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.29.9. The vulnerability exists because ActionUser::conditions_logic() gates the current_user_can('edit_user', $user_id) authorization check behind an is_numeric() test, causing the check to be skipped entirely when $user_id is a non-numeric string - a condition that can be induced by passing a crafted value such as 1one through the unvalidated item_id parameter of the unauthenticated wp_ajax_nopriv_frontend_admin/forms/change_form AJAX endpoint. This makes it possible for attackers to escalate privileges to administrator by obtaining a server-signed _acf_objects payload carrying the non-numeric user ID, which WordPress subsequently coerces to integer 1 (the default administrator), allowing the attacker to overwrite that account's password or email address. Exploitation by unauthenticated users requires a public-facing frontend user form to be configured; in all other cases a subscriber-level account is sufficient.

AnalysisAI

Privilege escalation in the Frontend Admin by DynamiApps WordPress plugin (all versions through 3.29.9) lets attackers take over the default administrator account by overwriting its password or email. The flaw stems from an authorization check that is silently skipped when the target user ID is a non-numeric string, which WordPress later coerces to integer 1 (the default admin). Where a public-facing frontend user form is configured the attack is fully unauthenticated; otherwise any subscriber-level account suffices. No public exploit identified at time of analysis, but the CVSS is 9.8 (Critical) and it was reported by Wordfence.

Technical ContextAI

The affected component is the ACF-based Frontend Admin plugin (internal slug acf-frontend-form-element), which renders WordPress user-management forms on the site frontend. In ActionUser::conditions_logic() the plugin wraps the current_user_can('edit_user', $user_id) capability check inside an is_numeric($user_id) test. When $user_id is a non-numeric string such as '1one', is_numeric() returns false and the entire authorization branch is skipped rather than failing closed. The crafted value enters through the unvalidated item_id parameter of the wp_ajax_nopriv_frontend_admin/forms/change_form AJAX action (the nopriv handler is reachable without authentication). The plugin then emits a server-signed _acf_objects payload carrying the string user ID; when this trusted payload is processed, PHP/WordPress integer-coerces '1one' to 1, targeting the first administrator account. This is a textbook CWE-269 (Improper Privilege Management) failure caused by an input-type assumption around the authorization gate.

RemediationAI

Upgrade the Frontend Admin by DynamiApps plugin to the first release above 3.29.9 that contains the fix; an upstream fix is available as a plugins.trac changeset (https://plugins.trac.wordpress.org/changeset?reponame=&old=3633030%40acf-frontend-form-element&new=3633030%40acf-frontend-form-element), but a specific released patched version is not independently confirmed from the provided data, so verify the fixed version against the Wordfence advisory before deploying. Until patched, remove or unpublish any public-facing frontend user/registration forms provided by this plugin to eliminate the unauthenticated (nopriv) path - the trade-off is loss of frontend self-service account management. As additional compensating controls, restrict or block access to admin-ajax.php requests carrying action=frontend_admin/forms/change_form at a WAF or reverse proxy, disable open user registration (Settings > General > Membership) to remove the subscriber-level path, and monitor for administrator email/password changes as a detection signal. Review the referenced advisory for the exact patched release before relying on version numbers.