CVE-2026-18432
Received Received - Intake

Privilege Escalation in Frontend Admin WordPress Plugin

Publication date: 2026-08-16

Last updated on: 2026-08-16

Assigner: Wordfence

Description
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.29.9. The vulnerability exists because `ActionUser::conditions_logic()` gates the `current_user_can('edit_user', $user_id)` authorization check behind an `is_numeric()` test, causing the check to be skipped entirely when `$user_id` is a non-numeric string — a condition that can be induced by passing a crafted value such as `1one` through the unvalidated `item_id` parameter of the unauthenticated `wp_ajax_nopriv_frontend_admin/forms/change_form` AJAX endpoint. This makes it possible for attackers to escalate privileges to administrator by obtaining a server-signed `_acf_objects` payload carrying the non-numeric user ID, which WordPress subsequently coerces to integer 1 (the default administrator), allowing the attacker to overwrite that account's password or email address. Exploitation by unauthenticated users requires a public-facing frontend user form to be configured; in all other cases a subscriber-level account is sufficient.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-16
Last Modified
2026-08-16
Generated
2026-08-16
AI Q&A
2026-08-16
EPSS Evaluated
N/A
NVD
CVE-2026-18432
EUVD
EUVD-2026-59849

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
dynamiapps frontend_admin to 3.29.9 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-269 The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Frontend Admin by DynamiApps WordPress plugin has a privilege escalation flaw in versions up to 3.29.9. The issue is in the `ActionUser::conditions_logic()` function, which incorrectly checks user permissions by first verifying if a user ID is numeric. If the ID is a non-numeric string like '1one', the permission check is skipped entirely. Attackers can exploit this by sending a crafted value through an unauthenticated AJAX endpoint, allowing them to escalate privileges to administrator level.

Detection Guidance

Check for unauthorized privilege changes in WordPress admin logs. Inspect AJAX requests to the endpoint wp_ajax_nopriv_frontend_admin/forms/change_form for non-numeric item_id parameters. Review user accounts for unexpected administrator role assignments or password/email modifications.

Impact Analysis

If exploited, this vulnerability allows unauthenticated attackers to gain administrator access to a WordPress site. This could lead to full site takeover, including the ability to install malicious plugins, modify content, steal data, or deface the website. Even with a subscriber account, attackers can escalate privileges under certain conditions.

Compliance Impact

This vulnerability allows unauthenticated attackers to escalate privileges to administrator level by exploiting improper input validation. This could lead to unauthorized access to sensitive data, including personal or health information, violating GDPR and HIPAA compliance requirements for data protection and access control.

Mitigation Strategies

Update the Frontend Admin by DynamiApps plugin to the latest version. Disable the plugin if not essential. Restrict access to the vulnerable AJAX endpoint via server rules. Monitor user accounts for suspicious activity and enforce strong password policies.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18432. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart