CVE-2026-7802
Authorization Bypass in Frontend Admin WordPress Plugin
Publication date: 2026-05-28
Last updated on: 2026-05-28
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| dynamiapps | frontend_admin | to 3.29.2 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The Frontend Admin by DynamiApps plugin for WordPress has an authorization bypass vulnerability in all versions up to and including 3.29.2. This occurs because the plugin does not properly verify if a user is authorized to perform certain actions.
As a result, authenticated users with subscriber-level access or higher can overwrite administrator profile fields such as user_pass, user_email, first_name, and last_name by supplying an arbitrary user_id value.
This enables a full administrator account takeover through direct password replacement or email-redirect password reset.
Exploitation requires the targeted Edit-User form to have its 'Roles' configuration setting left empty; if a non-empty roles list is configured, the vulnerability is mitigated by preventing targeting of administrators.
How can this vulnerability impact me? :
This vulnerability can lead to a complete administrator account takeover on a WordPress site using the affected plugin versions.
An attacker with subscriber-level access can escalate privileges to administrator by overwriting administrator credentials and profile information.
This can result in unauthorized control over the website, including the ability to change site settings, install malicious code, access sensitive data, and disrupt site operations.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, ensure that the 'Roles' configuration setting in the Frontend Admin plugin is not left empty. Configuring a non-empty roles list prevents unauthorized users from targeting administrator accounts through the Edit-User form.
Additionally, update the Frontend Admin plugin to a version later than 3.29.2 where this authorization bypass vulnerability is fixed.