Privilege Escalation Vulnerability in DynamiApps Frontend Admin Plugin for WordPress

CVE-2026-18432

What is CVE-2026-18432?

The DynamiApps Frontend Admin plugin for WordPress contains a vulnerability that allows unauthorized users to escalate their privileges. Specifically, the issue arises from the 'ActionUser::conditions_logic()' function which incorrectly implements an authorization check. If a non-numeric string is provided as a user ID through the unvalidated 'item_id' parameter of the AJAX endpoint, the 'current_user_can('edit_user', $user_id)' check may be bypassed. This flaw allows attackers to impersonate the administrator by exploiting default WordPress behavior that coerces the non-numeric user ID into the integer '1', ultimately enabling adversaries to change critical account information such as passwords or email addresses. Exploitation requires either a public-facing frontend user form or a subscriber-level account.

References