Frontend Admin by DynamiApps CVE-2026-6228

Exploitation requires three specific conditions to be met: (1) The WordPress site must have the Frontend Admin by DynamiApps plugin versions up to 3.28.36 installed and active. (2) The site must have public user registration enabled AND configured with a new_user form that grants editor-level privileges to newly registered accounts-this is NOT a default WordPress configuration and represents a specific deployment choice by site administrators. Sites with registration disabled or that assign only subscriber/contributor roles are not exploitable via the unauthenticated path. (3) The attacker must be able to create admin_form posts, which requires editor privileges due to the 'capability_type' => 'page' configuration. LIMITING FACTORS: Exploitation requires low privileges (editor account, PR:L) rather than unauthenticated access unless condition (2) is met. The vulnerability cannot be exploited by subscriber or contributor level accounts. Network access (AV:N) and no user interaction (UI:N) mean once an editor account is obtained, exploitation is straightforward. The attack complexity is low (AC:L) as it requires only basic HTTP request manipulation using browser developer tools or similar utilities. Sites following WordPress security best practices of limiting public registration roles and carefully vetting editor-level access have significantly reduced exposure.

Real-world risk is HIGH for installations with public user registration enabled. The CVSS vector (AV:N/AC:L/PR:L/UI:N) indicates network-accessible exploitation with low complexity requiring only low privileges (editor account), but this understates practical risk in certain deployment scenarios. Attack complexity is genuinely low: attackers need only (1) obtain editor access via public registration forms and (2) manipulate POST requests-both achievable with basic web debugging tools. The vulnerability enables complete site takeover through administrator privilege escalation, affecting confidentiality, integrity, and availability (C:H/I:H/A:H). No EPSS score or KEV status provided, suggesting exploitation is not yet widespread. However, the detailed technical disclosure including specific code references (class-role.php lines 107-110, post-types.php line 53) and patch changeset (3519460) provides a roadmap for exploit development. CRITICAL LIMITING FACTOR: Exploitation requires the site to have enabled public user registration AND configured new_user forms that grant editor role-not default WordPress behavior. Sites with registration disabled or that assign only subscriber/contributor roles to new users are NOT exploitable via the unauthenticated path described, though existing compromised editor accounts remain a risk vector. Administrators should immediately audit whether public registration grants editor privileges, as this significantly amplifies exploitability from opportunistic to remotely achievable by unauthenticated attackers.

An attacker discovers a WordPress site running Frontend Admin by DynamiApps 3.28.36 with public registration enabled. They register a new account via a public new_user form configured to grant editor privileges. Authenticated as an editor, the attacker navigates to the form creation interface and begins creating an edit_user form. Using browser developer tools, they intercept the POST request to wp-admin/post.php and inject 'administrator' into the role_options array in the form configuration JSON, bypassing the UI restrictions in feadmin_get_user_roles(). After saving the malicious form, they access it via the frontend and submit their own user ID with the administrator role selected. The vulnerable pre_update_value() function validates only that 'administrator' exists in the form's allowed roles array without checking the attacker's authorization to assign that role, successfully escalating their account to administrator. The attacker now has complete control over the WordPress site, including the ability to install malicious plugins, modify content, access sensitive data, and create persistent backdoors.