CVE-2026-15606

Deferred Deferred - Pending Action

Authorization Bypass in Frontend Admin WordPress Plugin

Publication date: 2026-08-11

Last updated on: 2026-08-12

Assigner: Wordfence

Description

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.29.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level and above permissions, to reset the password of any user on the site, including administrators, leading to full account takeover and complete site compromise. Exploitation requires the attacker to hold a valid encrypted Current-User token obtained by accessing any Edit User form they are legitimately authorized to submit, which they then use as a known-plaintext base for the CBC bit-flipping forgery.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-11

Last Modified

2026-08-12

Generated

2026-09-01

AI Q&A

2026-08-12

EPSS Evaluated

2026-08-30

NVD

CVE-2026-15606

Affected Vendors & Products

Vendor	Product	Version / Range
dynamiapps	frontend_admin	to 3.29.9 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

The Frontend Admin by DynamiApps WordPress plugin has an authorization bypass flaw in versions up to 3.29.9. It fails to verify user permissions properly, allowing authenticated attackers with subscriber-level access or higher to reset any user's password, including administrators. This leads to full account takeover and complete site compromise.

Detection Guidance

This vulnerability requires checking for unauthorized password resets or unusual user account modifications. Inspect WordPress logs for suspicious activity related to the Frontend Admin plugin, particularly any password reset requests or user role changes. Look for encrypted Current-User tokens in requests to edit user forms.

Impact Analysis

Attackers can take over any account on the site, including admin accounts, by resetting passwords. This gives them full control over the WordPress site, allowing them to modify content, install malicious plugins, steal data, or disrupt operations.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR and HIPAA requirements for data protection and access control. Organizations may face legal penalties, fines, and reputational damage due to non-compliance.

Mitigation Strategies

Immediately update the Frontend Admin by DynamiApps plugin to the latest version beyond 3.29.9 to patch the authorization bypass vulnerability. If an update is not available, consider disabling or removing the plugin until a fix is released.

Hi! I’m here to help you understand CVE-2026-15606. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70