Frontend Admin CVE-2026-42722

Exploitation requires an authenticated administrator account on the target WordPress site (CVSS PR:H), as reflected in the advisory title 'Administrator SQL Injection'; the attacker must reach a Frontend Admin by DynamiApps plugin feature that accepts user input and passes it into a SQL query without proper sanitization. The primary limiting factor is the administrator privilege prerequisite - this is not remotely exploitable by anonymous or low-privileged users - which confines the realistic threat to insiders, compromised admin credentials, or environments that grant admin roles to lower-trust users. No user interaction by a victim is required (UI:N), and it is reachable over the network via the web interface (AV:N). Affected deployments are those running plugin version 3.29.13 or earlier.

This is a high-CVSS (7.6) but modest-real-risk issue driven almost entirely by the privilege requirement. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N is internally consistent with the vulnerability name 'Administrator SQL Injection': PR:H confirms the attacker must already hold administrator-level access to the WordPress site, which sharply limits the realistic attacker population since a WordPress administrator is already highly privileged by design. The S:C/C:H/I:N/A:L impact set indicates the main consequence is unauthorized disclosure of database contents (potentially beyond the plugin's own scope) with limited availability impact and no integrity impact. On exploitation signals, no EPSS score, no CISA KEV listing, and no public exploit code were provided in the intelligence, so this is not a confirmed active-exploitation priority. There is a notable tension worth flagging: the network attack vector (AV:N) and scope-change (S:C) inflate the base score, yet the PR:H precondition means this is only exploitable by someone who already controls the admin panel - a context in which the incremental risk is far lower than the 7.6 suggests. Treat this as a routine 'patch in normal cycle' item rather than an emergency, unless the environment relies on lower-trust users holding administrator roles.

A user who already holds an administrator account on a WordPress site running Frontend Admin by DynamiApps 3.29.13 or earlier submits crafted input through a plugin feature that is passed unsanitized into a SQL query. This lets them inject SQL to read database contents beyond the intended interface. No public proof-of-concept exploit was identified in the provided data.