Executive brief
The Frontend Admin plugin for WordPress allows unauthenticated users to delete arbitrary files from a web server when the form is configured with public visibility. An attacker can delete critical files like wp-config.php to disable the site or execute malicious code, even without login credentials. This vulnerability poses an immediate risk to website availability and security for any site using this plugin with public forms.
Technical details
The vulnerability is a path traversal and arbitrary file deletion flaw in the move_folders function within the Frontend Admin plugin for WordPress. The vulnerable code fails to properly validate file paths supplied by the user, allowing directory traversal sequences to escape the intended directory. When a form is configured with public visibility (who_can_see='all'), the required nonce is publicly obtainable from the rendered HTML, eliminating authentication as a barrier. An unauthenticated attacker can craft a malicious request to delete any file accessible to the web server process, including wp-config.php or plugin files, leading to remote code execution or complete site compromise.
Affected products
- DynamiApps Frontend Admin up to and including 3.29.12
Timeline
- 2026-09-01: disclosed