Junglewise Threat Intelligence

CVE-2026-7802: DynamiApps Frontend Admin authorization bypass in Edit-User form

CVE-2026-7802 · Severity: high · CVSS 8.8 · Published 2026-05-28

Vendors: DynamiApps.

Executive brief

The Frontend Admin plugin for WordPress, which allows site owners to create front-facing forms for user management, contains a security flaw that allows low-level users to take over administrator accounts. By exploiting this vulnerability, an attacker can change an administrator's password or email address, gaining full control over the website. This could lead to complete site defacement, data theft, or the installation of malicious software.

Technical details

The Frontend Admin by DynamiApps plugin for WordPress (up to version 3.29.2) fails to perform adequate authorization checks when processing user profile updates. Authenticated attackers with subscriber-level permissions can exploit this by supplying an arbitrary 'user_id' parameter to the Edit-User form. This allows the attacker to overwrite sensitive profile fields, including 'user_pass' and 'user_email', for any user, including administrators. The vulnerability is exploitable when the 'Roles' configuration setting for the Edit-User form is left empty, as the 'load_data()' function fails to restrict the target user ID in this state. A patch is available in newer versions of the plugin.

Affected products

  • DynamiApps The Frontend Admin by DynamiApps up to, and including, 3.29.2

Timeline

  • 2026-05-28: disclosed: CVE published to NVD

References