Privilege Escalation Vulnerability in Frontend Admin Plugin for WordPress by DynamiApps

CVE-2026-6228

What is CVE-2026-6228?

The Frontend Admin plugin by DynamiApps for WordPress has a vulnerability that allows unauthorized users to escalate their privileges due to inadequate authorization checks within the role update mechanism. Specifically, the plugin's configuration permits editors to manipulate roles, enabling them to elevate their access to administrator level. When editors utilize the 'edit_user' functionality to create forms, they can include 'administrator' in the role options via direct POST requests, bypassing existing user interface restrictions. Consequently, this flaw allows potential attackers to register as editors and exploit the vulnerability to gain elevated permissions.

References