Frontend Admin CVE-2026-19952

Exploitation requires that at least one form created by the Frontend Admin by DynamiApps plugin be configured with public visibility via who_can_see='all', which causes WordPress to render the CSRF nonce value in the publicly accessible page HTML. Once that nonce is retrieved, no further authentication, privileges, or user interaction are required to invoke the vulnerable move_folders function and delete arbitrary server-accessible files. Limiting factors: if every plugin form is restricted to logged-in users (who_can_see set to any value other than 'all'), the nonce is never exposed to unauthenticated visitors and the attack path is broken at the nonce-retrieval step. Sites that have installed the plugin but have not created any frontend forms, or that have disabled the plugin, are not exploitable. No special network positioning, specific operating system, or non-default server configuration is required beyond a standard WordPress deployment on a PHP-capable web stack.

The supplied CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) correctly models the network attack vector and absence of authentication, but its impact metrics - C:H with I:N/A:N - are inconsistent with the described behavior: arbitrary file deletion is an integrity and availability impact, not a confidentiality one, and the path to RCE adds full C:H as well, placing true severity closer to 9.8. The CVSS score of 7.5 therefore significantly understates real-world risk. Even a mid-sized municipal IT team in gliwice operating a public-facing WordPress portal with at least one publicly visible frontend form should treat this as urgent, because the attack path requires no tooling beyond a browser and a crafted POST request. The absence of EPSS data and KEV listing means exploitation probability cannot be quantified, but the trivially retrievable nonce combined with a directory-traversal primitive creates conditions well-suited to automated scanning campaigns targeting WordPress installations at scale.

An attacker enumerates a WordPress site running Frontend Admin by DynamiApps ≤ 3.29.12, locates a publicly rendered frontend form (who_can_see='all'), and extracts the embedded nonce from the page HTML using a standard browser or curl. They then submit a crafted POST request to the plugin's file-management endpoint with a path-traversal string targeting wp-config.php, which is deleted without any further authorization check. On the next page load, WordPress enters its database-setup wizard, allowing the attacker to redirect the installation to an attacker-controlled database and gain full administrative code execution over the site.