Authorization Bypass Vulnerability in Frontend Admin Plugin by DynamiApps

CVE-2026-15606

What is CVE-2026-15606?

The Frontend Admin plugin by DynamiApps for WordPress is susceptible to an authorization bypass vulnerability affecting all versions up to and including 3.29.9. This flaw stems from inadequate user authorization checks, allowing authenticated attackers with subscriber-level access or higher to reset passwords for any user, including administrators. The exploitation of this vulnerability necessitates that the attacker possesses a valid encrypted Current-User token, which can be obtained by accessing any legitimately submitted Edit User form. By utilizing this token, an attacker can execute a CBC bit-flipping forgery, which can lead to a complete account takeover and compromise of the site.

References