Critical Auth Bypass in Frontend Admin Plugin Enables Full Account Takeover

Executive Summary

A critical authentication bypass vulnerability (CVE-2026-75816) has been disclosed in Frontend Admin by DynamiApps, a popular WordPress plugin used to build front-end forms and dashboards. The flaw carries a CVSS score of 9.8 and lets an unauthenticated attacker overwrite the email address on any user account — including an administrator's — and then ride WordPress's native password-reset flow straight to full account takeover.

CVSS Score: 9.8 (Critical)

The bug lives in the plugin's pre_update_value function, which performs no capability or ownership check before writing form submissions to user records. A companion logic flaw in ActionPost::conditions_logic() short-circuits its current_user_can('edit_post') gate whenever the submitted post ID is non-numeric (a string like user_1, for example) instead of a real post ID. Chaining the two lets an anonymous visitor route a form submission to arbitrary user records with no authorization check at all.

Vulnerability Overview

Affected Versions

This is not the plugin's first authentication issue. A related flaw, CVE-2026-15606, affected versions up to 3.29.9 and let authenticated subscriber-level users reset any user's password. WPScan's advisory history for this plugin also lists prior privilege-escalation and SQL injection findings — sites running older forks should treat a full update, not just a point patch, as the safe move.

Attack Vector

1. Attacker locates a site running Frontend Admin ≤ 3.29.12 with a public-facing form
2. Attacker submits the form with a non-numeric post ID (e.g. "user_1")
3. ActionPost::conditions_logic() short-circuits its current_user_can('edit_post') check
4. pre_update_value() writes the submitted value directly to a target user's record
   with no ownership check — attacker sets the victim's email to an address they control
5. Attacker triggers WordPress's native "lost password" flow for that account
6. Password-reset link is delivered to the attacker-controlled email
7. Attacker sets a new password and logs in as the victim — including as an administrator

Impact of Successful Exploitation

Immediate Remediation

Step 1: Update Immediately

# Via WP-CLI
wp plugin update frontend-admin
 
# Verify the installed version
wp plugin get frontend-admin --field=version

Or update via Plugins > Installed Plugins > Frontend Admin > Update Now in the WordPress dashboard. Confirm the reported version is 3.29.13 or later.

Step 2: Audit Recent Account Activity

# Check for unexpected email-address changes on user accounts
wp user list --fields=ID,user_login,user_email,user_registered
 
# Review the password-reset and login audit trail if a security plugin logs it
grep -i "password reset\|user_email" /path/to/wordpress/wp-content/debug.log

Look specifically for administrator accounts whose registered email address doesn't match what your team expects.

If Immediate Patching Is Not Possible

1. Deactivate the Frontend Admin plugin until the update can be applied
2. Disable or restrict public-facing forms built with the plugin
3. Enable two-factor authentication for all administrator accounts as defense in depth
4. Monitor for unauthorized email changes via a file/database integrity monitor

Detection Indicators

Post-Remediation Steps

1. Confirm plugin updated to 3.29.13 or later
2. Force-reset passwords for all administrator and editor accounts
3. Verify email addresses on record for every privileged account
4. Review for unauthorized admin accounts created during the exposure window
5. Rotate WordPress security keys and salts (wp config shuffle-salts)
6. Enable 2FA for all privileged accounts going forward

References

• Mallory — Critical Frontend Admin WordPress Plugin Flaw Enables Administrator Takeover
• WPScan — Frontend Admin by DynamiApps Vulnerability Database
• NIST NVD — CVE-2026-75816

Related Reading

• WordPress Plugin Vulnerability (CVSS 10.0) Under Active
• Critical Auth Bypass in Tutor LMS Pro Exposes 30,000+
• Critical RCE in WPvivid Backup Plugin Threatens 900,000+