CVE-2026-7802

Vulnerability

The Frontend Admin by DynamiApps plugin for WordPress (all versions up to and including 3.29.2) suffers from an authorization bypass vulnerability in its Edit-User form. The plugin fails to properly verify that the current user is authorized to edit a specified ?user_id= parameter. When the form's 'Roles' configuration setting is left empty, an authenticated attacker with subscriber-level access or above can supply a crafted ?user_id= value to overwrite any user's profile fields, including user_pass, user_email, first_name, and last_name. The vulnerability resides in the submit-handling logic found in the submit.php file (acf-frontend-form-element/trunk/main/frontend/forms/classes/submit.php) [1][2][3][4].

Exploitation

An attacker must be authenticated with at least subscriber-level permissions on the WordPress site. The targeted Edit-User form must be configured with an empty 'Roles' field (no allowed roles restriction). The attacker can then submit the form with a ?user_id= parameter set to the ID of an administrator. The form's back-end does not enforce ownership or role checks, so the attacker's submitted values—including a new user_pass—are accepted and written to the database. No additional user interaction is required beyond the attacker's own form submission.

Impact

Successful exploitation allows the attacker to completely take over the targeted administrator account. By modifying user_pass directly, the attacker can log in as that administrator immediately. Alternatively, changing the administrator's user_email enables a password-reset attack via the “Lost Password” flow. The attacker then gains full administrative access to the WordPress site, including the ability to execute code, modify themes and plugins, and exfiltrate data.

Mitigation

No fixed version has been released as of the CVE publication date (2026-05-28). The vendor has not yet addressed the vulnerability in a patch. As a workaround, site administrators can avoid leaving the Edit-User form's 'Roles' configuration empty; populating it with a restricted set of roles prevents the exploitation path by causing load_data() to set the user ID to 'none' for out-of-scope users. The plugin is not known to be listed on CISA's KEV as of this writing.