CVE-2026-19952
Received Received - Intake

Arbitrary File Deletion in Frontend Admin WordPress Plugin

Publication date: 2026-09-01

Last updated on: 2026-09-01

Assigner: Wordfence

Description
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the move_folders function in all versions up to, and including, 3.29.12. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This is exploitable without authentication when a form is configured with public visibility (who_can_see='all'), as the required nonce is publicly obtainable from the rendered form.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-01
Last Modified
2026-09-01
Generated
2026-09-01
AI Q&A
2026-09-01
EPSS Evaluated
N/A
NVD
CVE-2026-19952
EUVD
EUVD-2026-68973

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
dynamiapps frontend_admin to 3.29.12 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Frontend Admin by DynamiApps WordPress plugin has a flaw in its move_folders function that allows unauthenticated attackers to delete arbitrary files on the server. This happens because the plugin does not properly validate file paths before deletion. Attackers can exploit this to remove critical files like wp-config.php, which may lead to remote code execution.

Detection Guidance

Check for unauthorized file deletions in WordPress directories, especially wp-config.php. Look for suspicious activity in server logs related to the Frontend Admin plugin. No specific commands are provided in the context.

Impact Analysis

This vulnerability allows attackers to delete important files on your WordPress server without needing to log in. If they delete files like wp-config.php, they could take control of your website, steal data, or install malicious software. The attack is possible if a form is set to public visibility.

Compliance Impact

This vulnerability could lead to unauthorized file deletion, potentially exposing sensitive data such as configuration files (e.g., wp-config.php). If exploited, it may result in data breaches, violating GDPR or HIPAA requirements for data protection and integrity.

Mitigation Strategies

Immediately update the Frontend Admin plugin to the latest version beyond 3.29.12. Disable the plugin if not in use. Ensure forms are not set to public visibility (who_can_see='all'). Review server files for unauthorized deletions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19952. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart