What the vulnerability does
01Description
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the move_folders function in all versions up to, and including, 3.29.12. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This is exploitable without authentication when a form is configured with public visibility (who_can_see='all'), as the required nonce is publicly obtainable from the rendered form.
Explanation of Vulnerability in Simple Terms
02Summary
Frontend Admin by DynamiApps versions 3.29.12 and earlier contain a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files from the server. An attacker can craft requests to access files outside the intended directory, potentially exposing sensitive configuration files, database credentials, or other confidential data stored on the web server.
What an attacker can do
03Attacker Capabilities
Read arbitrary files from the server without authentication.
Potential impact on your site
04Site Impact
Sensitive files (config, credentials, source code) may be exposed to unauthenticated attackers.
Conditions required to exploit
05Prerequisites
Network access to the vulnerable application; no authentication or user interaction required.
Key dates
06Disclosure timeline
September 1, 2026
CVE published
September 1, 2026
Record updated
