CVE-2026-75816 in Frontend Admin Plugin
Summary
by MITRE • 09/06/2026
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Authentication Bypass to Account Takeover in all versions up to, and including, 3.29.12. This is due to the pre_update_value function lacking any capability or ownership check, and ActionPost::conditions_logic() short-circuiting its current_user_can('edit_post') authorization gate whenever the post ID is non-numeric — such as the string user_1 — allowing unauthenticated form submissions to be routed to arbitrary user records without restriction. This makes it possible for unauthenticated attackers to overwrite any user's registered email address, including an administrator's, and then leverage WordPress's native password-reset flow to fully take over the targeted account.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/06/2026
The vulnerability identified in Frontend Admin by DynamiApps affects all versions up to 3.29.12 on WordPress platforms. This security flaw represents a critical authentication bypass that enables unauthenticated attackers to achieve full account takeover of any user within the system, including those with administrative privileges. The root cause lies in two distinct but complementary code deficiencies: one involving data validation logic and the other concerning authorization checks. Specifically, the pre_update_value function fails to perform necessary capability or ownership verification before processing updates. This absence of a gate allows arbitrary modifications to be initiated without verifying that the requester has permission to alter the target resource.
Compounding this issue is the behavior of the ActionPost::conditions_logic() method within the plugin's architecture. Under normal circumstances, WordPress enforces access control through the current_user_can('edit_post') function, which ensures that only authorized users can modify specific posts or user records managed by the plugin. However, in this vulnerable implementation, if the post ID provided is non-numeric—such as a string formatted like user_1—the conditions_logic method short-circuits and bypasses the current_user_can check entirely. This logic error effectively neutralizes the authorization layer for any request where the identifier does not conform to expected numeric formats, creating an open path for unauthenticated manipulation of user data.
The operational impact of this vulnerability is severe due to its direct link to account compromise via standard WordPress mechanisms. An attacker can exploit these flaws by submitting crafted HTTP requests that target arbitrary user records using non-numeric identifiers. By doing so, the attacker can overwrite critical profile fields, most notably the registered email address associated with a victim's account. Once the email is changed to one controlled by the attacker, they can leverage WordPress's native password-reset functionality. This flow sends a reset link to the newly set email address, allowing the attacker to establish a new password and gain full access to the compromised account without ever needing valid credentials for that specific user initially.
This vulnerability aligns with CWE-287, which describes Improper Authentication, as well as CWE-639 regarding Authorization Bypass through User-Controlled Key. From an ATT&CK perspective, this exploitation technique maps to T1078 Valid Accounts and potentially T1528 Steal Application Access Token if session cookies are harvested during the takeover process. The ability to reset passwords for administrative accounts poses a significant risk to overall infrastructure security, as it can lead to complete system compromise, data exfiltration, or further lateral movement within the network environment dependent on that WordPress installation.
Mitigation strategies must prioritize immediate patching of the Frontend Admin plugin to version 3.29.13 or later, where these logic flaws have been addressed by developers. Until an update is applied, administrators should consider disabling user registration if not strictly necessary and restricting access to wp-admin directories via IP whitelisting for trusted sources only. Additionally, implementing Web Application Firewall rules that detect anomalous patterns in post ID parameters could provide a temporary layer of defense against exploitation attempts involving non-numeric identifiers. Regular auditing of plugin code for proper authorization checks on all update operations is also recommended to prevent similar vulnerabilities from being introduced in future updates or third-party integrations.