Frontend Admin by DynamiApps CVE-2026-81347

Exploitation requires that the target WordPress site has the Frontend Admin by DynamiApps plugin configured with a file-deletion form feature that is not enabled by default - administrators must have explicitly created such a form as part of a custom workflow. This non-default configuration is the critical gating condition: sites using the plugin in its default state are not vulnerable. The attack is unauthenticated (PR:N) and requires no user interaction on the victim's part once the form is reachable, but the attacker must identify that the non-default form is present and accessible. The impact is limited to deletion of index.php and .htaccess; no arbitrary file deletion, code execution, or data exfiltration is described. Exploitation is constrained to WordPress sites running PHP with Apache (or compatible) where .htaccess is functional.

The CVSS 3.1 base score of 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects an accurate assessment: while the attack is network-reachable and requires no authentication, the High Complexity metric captures the non-default form configuration prerequisite. The C:N/I:N scoring aligns with the destructive-but-non-exfiltrating nature of the vulnerability; only availability is impacted. A public POC is available per WPScan, which raises practical risk above theoretical, but exploitation is gated behind a specific plugin configuration that most site operators do not enable. No CISA KEV listing is present, and no EPSS data was provided in the input. The primary real-world threat is targeted site disruption or vandalism rather than broad automated exploitation. The severity is functionally closer to a targeted denial-of-service than a critical compromise: no data is exposed, no code executes, but the WordPress site becomes inoperable upon successful exploitation.

An attacker identifies a WordPress site with the Frontend Admin by DynamiApps plugin configured to expose a file-deletion form (a non-default setting). Using the publicly available WPScan proof-of-concept, the attacker crafts an unauthenticated HTTP request with a manipulated directory path parameter containing traversal sequences, causing the plugin to delete index.php and .htaccess from the WordPress root. The site immediately becomes inoperable, returning HTTP errors to all visitors until the files are manually restored.