# CVE-2026-10039: DynamiApps Frontend Admin SQL Injection in order parameter

Source: https://junglewise.ai/threats/cve-2026-10039-dynamiapps-frontend-admin-sql-injection-in-order-parameter  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-29. Updated: 2026-05-29  
License: CC BY 4.0 with a link back

CVE-2026-10039 · Severity: medium · CVSS 4.9 · Published 2026-05-29

The Frontend Admin by DynamiApps plugin for WordPress, which allows users to manage site content from the front end, is vulnerable to a security flaw that could allow an administrator to access sensitive database information. By manipulating specific web requests, an authorized user with high-level permissions can run unauthorized database commands. This could lead to the exposure of confidential site data, though it requires existing administrative access to exploit.

Technologies: [DynamiApps Frontend Admin](https://junglewise.ai/threats/technologies/frontend-admin). Vendors: [DynamiApps](https://junglewise.ai/threats/vendors/dynamiapps).

## Quick answers

**Is CVE-2026-10039 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-10039 being exploited in the wild.

**How severe is CVE-2026-10039?** Medium severity, with a CVSS score of 4.9, published 29 May 2026.

**Which products and versions are affected?** DynamiApps Frontend Admin Up to and including 3.28.28.

**Is there a fix for CVE-2026-10039?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-10039 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-10039?** Check whether you run DynamiApps Frontend Admin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to a generic SQL Injection via the 'order' parameter in versions up to and including 3.28.28. This is due to insufficient escaping of user-supplied input and a lack of proper preparation of the SQL query within the payments list component. An authenticated attacker with administrator-level privileges can append additional SQL queries to existing ones to extract sensitive data. To successfully exploit the vulnerability, the attacker must also provide a valid 'orderby' parameter in the same request to reach the vulnerable code path. A patch appears to be available in version 3.29.3.

## Affected products

- DynamiApps Frontend Admin by DynamiApps Up to and including 3.28.28

## Timeline

- 2026-05-29: disclosed: Initial disclosure by Wordfence and NVD publication.

## References

- [https://plugins.trac.wordpress.org/browser/acf-frontend-form-element/tags/3.29.3/main/admin/admin-pages/payments/list.php](https://plugins.trac.wordpress.org/browser/acf-frontend-form-element/tags/3.29.3/main/admin/admin-pages/payments/list.php)
- [https://plugins.trac.wordpress.org/browser/acf-frontend-form-element/tags/3.29.3/main/admin/admin-pages/payments/list.php](https://plugins.trac.wordpress.org/browser/acf-frontend-form-element/tags/3.29.3/main/admin/admin-pages/payments/list.php)
- [https://plugins.trac.wordpress.org/browser/acf-frontend-form-element/trunk/main/admin/admin-pages/payments/list.php](https://plugins.trac.wordpress.org/browser/acf-frontend-form-element/trunk/main/admin/admin-pages/payments/list.php)
- [https://plugins.trac.wordpress.org/browser/acf-frontend-form-element/trunk/main/admin/admin-pages/payments/list.php](https://plugins.trac.wordpress.org/browser/acf-frontend-form-element/trunk/main/admin/admin-pages/payments/list.php)
- [https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3472098%40acf-frontend-form-element&new=3472098%40acf-frontend-form-element&sfp_email=&sfph_mail=](https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3472098%40acf-frontend-form-element&new=3472098%40acf-frontend-form-element&sfp_email=&sfph_mail=)
- [https://www.wordfence.com/threat-intel/vulnerabilities/id/51d79701-8580-4130-8f84-e739aa2f7f5f?source=cve](https://www.wordfence.com/threat-intel/vulnerabilities/id/51d79701-8580-4130-8f84-e739aa2f7f5f?source=cve)

## Related threats

- [DynamiApps Frontend Admin stored XSS vulnerability](https://junglewise.ai/threats/cve-2026-119504-improper-neutralization-of-input-during-web-page-generation)
- [DynamiApps Frontend Admin privilege escalation in acf-frontend-form-element](https://junglewise.ai/threats/cve-2026-119506-incorrect-privilege-assignment-vulnerability-in-dynamiapps)
- [Frontend Admin by DynamiApps SQL injection](https://junglewise.ai/threats/cve-2026-42722-administrator-sql-injection-in-frontend-admin-by-dynamiapps-3-29)
- [Frontend Admin by DynamiApps stored XSS via kses bypass](https://junglewise.ai/threats/cve-2026-6243-the-frontend-admin-by-dynamiapps-plugin-for-wordpress-is)
- [DynamiApps Frontend Admin authentication bypass to account takeover](https://junglewise.ai/threats/cve-2026-75816-dynamiapps-frontend-admin-authentication-bypass-to-account)