Executive brief
The Frontend Admin plugin for WordPress, which allows site owners to create front-facing forms for user management, contains a security flaw that allows low-level users to take over administrator accounts. By exploiting this vulnerability, an attacker can change an administrator's password or email address, gaining full control over the website. This could lead to complete site defacement, data theft, or the installation of malicious software.
Technical details
The Frontend Admin by DynamiApps plugin for WordPress (up to version 3.29.2) fails to perform adequate authorization checks when processing user profile updates. Authenticated attackers with subscriber-level permissions can exploit this by supplying an arbitrary 'user_id' parameter to the Edit-User form. This allows the attacker to overwrite sensitive profile fields, including 'user_pass' and 'user_email', for any user, including administrators. The vulnerability is exploitable when the 'Roles' configuration setting for the Edit-User form is left empty, as the 'load_data()' function fails to restrict the target user ID in this state. A patch is available in newer versions of the plugin.
Affected products
- DynamiApps The Frontend Admin by DynamiApps up to, and including, 3.29.2
Timeline
- 2026-05-28: disclosed: CVE published to NVD
References
- https://plugins.trac.wordpress.org/browser/acf-frontend-form-element/tags/3.28.36/main/frontend/forms/actions/user.php
- https://plugins.trac.wordpress.org/browser/acf-frontend-form-element/tags/3.28.36/main/frontend/forms/actions/user.php
- https://plugins.trac.wordpress.org/browser/acf-frontend-form-element/tags/3.28.36/main/frontend/forms/classes/submit.php
- https://plugins.trac.wordpress.org/browser/acf-frontend-form-element/tags/3.28.36/main/frontend/forms/classes/submit.php
- https://plugins.trac.wordpress.org/browser/acf-frontend-form-element/tags/3.29.1/main/frontend/forms/actions/user.php
- https://plugins.trac.wordpress.org/browser/acf-frontend-form-element/tags/3.29.1/main/frontend/forms/actions/user.php
- https://plugins.trac.wordpress.org/browser/acf-frontend-form-element/tags/3.29.1/main/frontend/forms/classes/submit.php