EUVD-2026-32706
GHSA-pr4r-gmw2-wm5r
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessRegister subscriber account on target site
-
DeliveryLocate Frontend Admin Edit-User form with empty Roles
-
ExploitSubmit form with ?user_id=1 and attacker-chosen password/email
-
ExecutionPlugin overwrites administrator credentials without authorization check
-
PersistLog in as administrator or trigger password reset to attacker inbox
-
ImpactFull site takeover and persistent admin access
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Attacker must hold a valid WordPress account at subscriber level or higher (CVSS PR:L), and the target site must have at least one Frontend Admin by DynamiApps Edit-User form rendered on a reachable page with its 'Roles' configuration setting left empty - when Roles is populated, load_data() forces the target user ID to 'none' for out-of-scope roles and administrators cannot be targeted through that form. No user interaction by the victim is required (UI:N), no MFA bypass is needed, and the attack works against default WordPress installations where open registration is enabled and the site administrator configured an Edit-User form without restricting Roles; conversely, sites that disable public registration or always populate the form's Roles allow-list materially limit exploitability. |
| Impact | The CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects a network-reachable, low-complexity attack requiring only subscriber-level credentials and yielding full administrator takeover. No EPSS score, KEV listing, or SSVC decision was provided in the input, and no public exploit identified at time of analysis, so real-world exploitation cadence is unverified. The most important nuance is the configuration prerequisite: exploitability is gated by the per-form 'Roles' setting being empty, so the install-wide attack surface depends on how each site administrator configured their forms. WordPress sites that allow open subscriber registration and expose at least one Edit-User form with an empty Roles list should treat this as a high-priority patch; sites that restrict registration or always populate the Roles allow-list face materially lower risk. Given that subscriber-tier WordPress takeover chains are routinely automated by mass scanners against the WordPress plugin ecosystem, this should be treated as a real priority rather than a theoretical issue. |
| Exploit ScenarioDerived | An attacker registers a free subscriber account on a WordPress site running Frontend Admin by DynamiApps with at least one Edit-User form whose Roles setting is empty, then submits that form with ?user_id= set to the administrator's user ID (typically 1) and a new user_pass or user_email value. The plugin writes the new password or email to the administrator account without an authorization check, after which the attacker either logs in directly with the new password or triggers a password-reset email to an attacker-controlled inbox and seizes the site. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – May 28, 2026
Privilege escalation in the Frontend Admin by DynamiApps WordPress plugin (versions up to and including 3.29.2) allows authenticated subscriber-level users to overwrite arbitrary user profile fields - including administrator passwords and email addresses - by supplying a chosen user_id parameter to a vulnerable Edit-User form. This authorization-bypass flaw (CWE-862) enables full administrator account takeover through direct password replacement or email-redirect password reset, and no public exploit identified at time of analysis. The vulnerability requires a specific misconfiguration where the form's Roles setting is left empty, which limits exploitable installs but is a common default state.
RemediationAI
Upgrade Frontend Admin by DynamiApps to a release newer than 3.29.2 once the vendor publishes a fix; the WordPress.org changeset 3525193 (https://plugins.trac.wordpress.org/changeset?old=3525193%40acf-frontend-form-element&new=3525193%40acf-frontend-form-element) reflects upstream activity on the relevant files, and an upstream fix is referenced although a tagged patched version is not independently confirmed from the provided data - verify the current installed version against the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/cd091bd5-6b6a-4964-9249-525bbbec702c. As an immediate compensating control on unpatched sites, edit every Frontend Admin Edit-User form and populate the 'Roles' configuration with a non-empty allow-list excluding 'administrator', which causes load_data() to set out-of-scope target IDs to 'none' and blocks the takeover path (trade-off: each form must be audited individually, and any form left with empty Roles remains exploitable). Additionally, restrict or disable open subscriber registration (Settings → General → 'Anyone can register') to remove the low-cost attacker foothold required by PR:L, and consider a WAF rule blocking unexpected ?user_id= parameters on the plugin's submit endpoints until the upgrade is applied.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The plugin (internally named acf-frontend-form-element, vendor 'shabti') provides frontend WordPress administrative forms allowing site visitors and members to edit their own profile via Advanced Custom Fields-driven forms. The root cause is CWE-862 (Missing Authorization): the load_data() function in frontend/forms/actions/user.php and the submit logic in frontend/forms/classes/submit.php accept a user-supplied ?user_id= parameter and apply field updates without verifying that the requesting user is authorized to modify the target account. The plugin includes a partial mitigation - when a non-empty Roles allow-list is configured, load_data() reassigns the user ID to 'none' for out-of-scope targets - but when Roles is left empty (the default for many simple member-profile forms), no role check occurs and the requesting user can target any account including administrators.
Know when Frontend Admin By Dynamiapps gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.29.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite an administrator's user_pass, user_email, first_name, last_name, and other profile fields by supplying an arbitrary ?user_id= value, enabling full administrator account takeover via direct password replacement or email-redirect password reset. Exploitation requires the targeted Edit-User form to have its 'Roles' configuration setting left empty; when a non-empty roles list is configured, load_data() sets the user ID to 'none' for users whose roles fall outside the allowed list, preventing administrators from being targeted through that form.
Executive ViewAI
The Frontend Admin by DynamiApps WordPress plugin (versions up to 3.29.2) contains a privilege escalation flaw that allows authenticated subscriber-level users to directly modify administrator credentials, enabling full account takeover. Organizations operating this plugin face immediate risk of administrative compromise and complete loss of WordPress control. No patch is currently available, requiring immediate mitigation.
Immediately disable the Frontend Admin plugin or restrict access to administrator users only. Ensure the form's Roles setting is configured (not empty). Implement multi-factor authentication on all WordPress admin accounts. Enable audit logging for user profile changes. Conduct weekly reviews of administrator account modifications. Monitor for suspicious login attempts to admin accounts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Frontend Admin By Dynamiapps
View allStored cross-site scripting in the Frontend Admin by DynamiApps WordPress plugin (all versions before 3.29.9) allows una
Missing authorization in Frontend Admin by DynamiApps WordPress plugin (versions before 3.29.7) exposes taxonomy term cr
Unauthenticated path traversal file deletion in the Frontend Admin by DynamiApps WordPress plugin before 3.29.13 allows
Unauthenticated account takeover in the Frontend Admin by DynamiApps WordPress plugin (all versions through 3.29.12) let
Privilege escalation in the Frontend Admin by DynamiApps WordPress plugin (all versions through 3.29.9) lets attackers t
Privilege escalation in the Frontend Admin by DynamiApps WordPress plugin (versions up to and including 3.29.10) lets re
Password reset authorization bypass in the Frontend Admin by DynamiApps WordPress plugin (all versions through 3.29.9) a
Privilege escalation in Frontend Admin by DynamiApps plugin allows authenticated attackers with editor-level access to e
Unauthenticated privilege escalation in the Frontend Admin by DynamiApps WordPress plugin (versions up to and including
Unauthorized deletion of arbitrary membership plans is possible in the Frontend Admin by DynamiApps WordPress plugin (al
Unauthenticated arbitrary file deletion in the Frontend Admin by DynamiApps WordPress plugin (versions up to and includi
SQL injection in the Frontend Admin by DynamiApps WordPress plugin (all versions up to and including 3.29.13) lets an au
Exploit-DB