Description

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.29.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level and above permissions, to reset the password of any user on the site, including administrators, leading to full account takeover and complete site compromise. Exploitation requires the attacker to hold a valid encrypted Current-User token obtained by accessing any Edit User form they are legitimately authorized to submit, which they then use as a known-plaintext base for the CBC bit-flipping forgery.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-11T21:17:27.847Z",
  "pubdate": "2026-08-11T21:17:27.847Z",
  "executiveSummary": "The Frontend Admin by DynamiApps plugin for WordPress in all versions up to, and including, 3.29.9 is susceptible to an authorization bypass vulnerability.\nThe flaw exists due to inadequate verification of user authorization to perform administrative actions, specifically allowing authenticated users with subscriber-level permissions and above to reset the password of any user on the system, including site administrators.\nThis leads directly to full account takeover and complete site compromise.\nSuccessful exploitation requires the attacker to possess a valid encrypted Current-User token, which can be acquired by accessing any Edit User form that the attacker is legitimately authorized to submit.\nThis token is subsequently leveraged as a known-plaintext base to execute a Cipher Block Chaining (CBC) bit-flipping forgery attack.\nThe risk implication is severe, as low-privileged users can escalate their privileges to administrative control over the affected WordPress installation.",
  "technicalDetails": "The root cause of the vulnerability lies in the improper verification of user authorization within the Frontend Admin by DynamiApps plugin, coupled with insecure handling and cryptographic implementation of user state tokens.\nSpecifically, the affected component fails to cryptographically secure or appropriately validate authorization parameters associated with user profile updates and password resets.\nThe attack flow requires the attacker to first authenticate to the WordPress site with subscriber-level privileges.\nThe attacker then accesses an Edit User form they are legitimately authorized to submit in order to acquire a valid encrypted Current-User token.\nBecause the underlying encryption mode utilizes Cipher Block Chaining (CBC) without proper integrity checks or authentication mechanisms such as an HMAC, the attacker can leverage the obtained encrypted token as a known-plaintext base.\nBy performing a CBC bit-flipping forgery attack against the token, the attacker manipulates the ciphertext bytes to alter the decrypted plaintext parameters maliciously.\nWhen this forged token is submitted back to the vulnerable endpoint, the application incorrectly trusts the integrity and authorization claims of the manipulated data.\nThis circumvents the access control checks, allowing the authenticated attacker to execute unauthorized password reset routines for targeted accounts, including privileged administrative users.\nPost-exploitation impact includes full account takeover, granting the attacker the ability to manage plugins, execute arbitrary code, or perform any administrative function, ultimately resulting in complete site compromise.\nThe vulnerability affects all plugin versions up to, and including, 3.29.9 and is exploitable over the network by any authenticated user holding subscriber-level permissions or higher."
}