Executive brief
Frontend Admin by DynamiApps is a WordPress plugin that allows website administrators to create custom forms and interface components. A vulnerability in versions before 3.29.13 allows unauthenticated attackers to delete critical website files (such as index.php and .htaccess) through improper validation of directory paths, potentially rendering the entire website inoperable without requiring authentication.
Technical details
The plugin fails to properly validate user-controllable directory paths before performing file deletion operations, enabling a classic path traversal attack (CWE-73). An unauthenticated attacker can craft requests to delete files outside the intended directory, including system files in the WordPress root directory such as index.php and .htaccess. The attack requires the site to have a non-default form configuration. The vulnerability is fixed in version 3.29.13 and later.
Affected products
- DynamiApps Frontend Admin before 3.29.13
Timeline
- 2026-09-02: disclosed
- 2026-09-02: patched: Fixed in version 3.29.13