CVE-2026-18432
CriticalCVSS 9.8Summary
The Frontend Admin by DynamiApps plugin for WordPress up to version 3.29.9 contains a privilege escalation vulnerability. It stems from a flawed condition in the `ActionUser::conditions_logic()` function that skips the authorization check when the user ID is a string, allowing an attacker to escalate privileges to administrator.
Risk Assessment
An attacker can take over an administrator account by changing the password or email address, leading to full compromise of the WordPress site.
Recommendation
Update the plugin to the latest patched version. Additionally, restrict access to public frontend forms and monitor for unusual AJAX requests.
Original NVD description (English source)
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.29.9. The vulnerability exists because `ActionUser::conditions_logic()` gates the `current_user_can('edit_user', $user_id)` authorization check behind an `is_numeric()` test, causing the check to be skipped entirely when `$user_id` is a non-numeric string — a condition that can be induced by passing a crafted value such as `1one` through the unvalidated `item_id` parameter of the unauthenticated `wp_ajax_nopriv_frontend_admin/forms/change_form` AJAX endpoint. This makes it possible for attackers to escalate privileges to administrator by obtaining a server-signed `_acf_objects` payload carrying the non-numeric user ID, which WordPress subsequently coerces to integer 1 (the default administrator), allowing the attacker to overwrite that account's password or email address. Exploitation by unauthenticated users requires a public-facing frontend user form to be configured; in all other cases a subscriber-level account is sufficient.