CVE-2026-18432

Name of the Vulnerable Software and Affected Versions Frontend Admin by DynamiApps versions prior to 3.30.0

Description This issue allows for privilege escalation due to improper authorization checks in the ActionUser::conditions logic() function. The authorization check current user can('edit user', $user id) is bypassed when the $user id is a non-numeric string, which can be triggered by providing a crafted value to the item id parameter at the wp ajax nopriv frontend admin/forms/change form AJAX endpoint. An attacker can obtain a server-signed acf objects payload with a non-numeric user ID that WordPress coerces to integer 1, enabling the attacker to overwrite the administrator account's password or email address. Unauthenticated exploitation is possible if a public-facing frontend user form is configured; otherwise, a subscriber-level account is required.

Recommendations Update the plugin to a version newer than 3.29.9. Restrict access to the wp ajax nopriv frontend admin/forms/change form endpoint or disable public-facing frontend user forms to mitigate the risk of unauthenticated exploitation.